initial commit

.gitignore

···
+bin/

Makefile

···
+.PHONY: build install clean tidy test
+
+# Build variables
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
+LDFLAGS := -ldflags "-X main.version=$(VERSION)"
+BINARY := talos-upgrade
+
+# Default target
+all: build
+
+# Build the binary
+build:
+	go build $(LDFLAGS) -o bin/$(BINARY) ./cmd/talos-upgrade
+
+# Build for multiple platforms
+build-all:
+	GOOS=linux GOARCH=amd64 go build $(LDFLAGS) -o bin/$(BINARY)-linux-amd64 ./cmd/talos-upgrade
+	GOOS=linux GOARCH=arm64 go build $(LDFLAGS) -o bin/$(BINARY)-linux-arm64 ./cmd/talos-upgrade
+	GOOS=darwin GOARCH=amd64 go build $(LDFLAGS) -o bin/$(BINARY)-darwin-amd64 ./cmd/talos-upgrade
+	GOOS=darwin GOARCH=arm64 go build $(LDFLAGS) -o bin/$(BINARY)-darwin-arm64 ./cmd/talos-upgrade
+
+# Install to GOPATH/bin
+install:
+	go install $(LDFLAGS) ./cmd/talos-upgrade
+
+# Clean build artifacts
+clean:
+	rm -rf bin/
+
+# Tidy dependencies
+tidy:
+	go mod tidy
+
+# Run tests
+test:
+	go test -v ./...
+
+# Run with dry-run
+dry-run: build
+	./bin/$(BINARY) --dry-run status
+
+# Show help
+help:
+	@echo "Available targets:"
+	@echo "  build      - Build the binary to bin/"
+	@echo "  build-all  - Build for multiple platforms"
+	@echo "  install    - Install to GOPATH/bin"
+	@echo "  clean      - Remove build artifacts"
+	@echo "  tidy       - Tidy go.mod dependencies"
+	@echo "  test       - Run tests"
+	@echo "  dry-run    - Build and run status in dry-run mode"
+	@echo "  help       - Show this help"

cmd/talos-upgrade/main.go

···
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/evanjarrett/homelab/internal/cmd"
+)
+
+// Version is set at build time
+var version = "dev"
+
+func main() {
+	// Handle interrupt signal
+	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer cancel()
+
+	if err := cmd.Execute(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+}

configs/talos-profiles.yaml

···
+# Talos Upgrade Configuration
+# Node profiles and cluster topology for talos-upgrade tool
+
+settings:
+  factory_base_url: "https://factory.talos.dev"
+  default_timeout_seconds: 600
+  default_preserve: true
+  github_releases_url: "https://api.github.com/repos/siderolabs/talos/releases/latest"
+
+# Node profiles define the hardware configurations
+profiles:
+  amd64:
+    description: "Intel GPU nodes with secureboot"
+    arch: amd64
+    platform: metal
+    secureboot: true
+    kernel_args:
+      - pci=realloc
+      - amd_iommu=off
+    extensions:
+      - siderolabs/amd-ucode
+      - siderolabs/amdgpu
+      - siderolabs/gasket-driver
+      - siderolabs/i915
+      - siderolabs/intel-ucode
+      - siderolabs/iscsi-tools
+      - siderolabs/nut-client
+      - siderolabs/realtek-firmware
+      - siderolabs/thunderbolt
+      - siderolabs/util-linux-tools
+      - siderolabs/xe
+
+  arm64-rpi:
+    description: "Raspberry Pi workers"
+    arch: arm64
+    platform: metal
+    secureboot: false
+    overlay:
+      name: rpi_generic
+      image: siderolabs/sbc-raspberrypi
+    extensions:
+      - siderolabs/iscsi-tools
+      - siderolabs/util-linux-tools
+
+  arm64-turing:
+    description: "Turing RK1 workers"
+    arch: arm64
+    platform: metal
+    secureboot: false
+    overlay:
+      name: turingrk1
+      image: siderolabs/sbc-rockchip
+    extensions:
+      - siderolabs/iscsi-tools
+      - siderolabs/util-linux-tools
+
+# Detection rules for automatic profile matching
+# Nodes are discovered via Talos cluster members API
+# Profiles are detected based on hardware info
+detection:
+  rules:
+    - profile: arm64-rpi
+      match:
+        system_manufacturer: raspberrypi
+        arch: arm64
+
+    - profile: arm64-turing
+      match:
+        system_manufacturer: turing
+        arch: arm64
+
+    - profile: amd64
+      match:
+        arch: amd64

go.mod

···
+module github.com/evanjarrett/homelab
+
+go 1.25.5
+
+require (
+	github.com/cosi-project/runtime v1.13.0
+	github.com/fatih/color v1.18.0
+	github.com/siderolabs/talos/pkg/machinery v1.12.0
+	github.com/spf13/cobra v1.10.2
+	github.com/stretchr/testify v1.11.1
+	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/api v0.35.0
+	k8s.io/apimachinery v0.35.0
+	k8s.io/client-go v0.35.0
+)
+
+require (
+	cel.dev/expr v0.24.0 // indirect
+	github.com/ProtonMail/go-crypto v1.3.0 // indirect
+	github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect
+	github.com/ProtonMail/gopenpgp/v2 v2.9.0 // indirect
+	github.com/adrg/xdg v0.5.3 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cloudflare/circl v1.6.2 // indirect
+	github.com/containerd/go-cni v1.1.13 // indirect
+	github.com/containernetworking/cni v1.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/gertd/go-pluralize v0.2.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v0.22.4 // indirect
+	github.com/go-openapi/jsonreference v0.21.4 // indirect
+	github.com/go-openapi/swag v0.25.4 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/netutils v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
+	github.com/google/cel-go v0.26.1 // indirect
+	github.com/google/gnostic-models v0.7.1 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
+	github.com/jsimonetti/rtnetlink/v2 v2.1.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mdlayher/ethtool v0.4.0 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.8.0 // indirect
+	github.com/mdlayher/socket v0.5.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/opencontainers/runtime-spec v1.3.0 // indirect
+	github.com/petermattis/goid v0.0.0-20251121121749-a11dd1a45f9a // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20241121165744-79df5c4772f2 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	github.com/sasha-s/go-deadlock v0.3.6 // indirect
+	github.com/siderolabs/crypto v0.6.4 // indirect
+	github.com/siderolabs/gen v0.8.6 // indirect
+	github.com/siderolabs/go-api-signature v0.3.12 // indirect
+	github.com/siderolabs/go-pointer v1.0.1 // indirect
+	github.com/siderolabs/net v0.4.0 // indirect
+	github.com/siderolabs/protoenc v0.2.4 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
+	golang.org/x/exp v0.0.0-20250128182459-e0ece0dbea4c // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
+	google.golang.org/grpc v1.78.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e // indirect
+	k8s.io/utils v0.0.0-20251222233032-718f0e51e6d2 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.1 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)

go.sum

···
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
+github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ekTTXpdwKYF8eBlsYsDVoggDAuAjoK66k=
+github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw=
+github.com/ProtonMail/gopenpgp/v2 v2.9.0 h1:ruLzBmwe4dR1hdnrsEJ/S7psSBmV15gFttFUPP/+/kE=
+github.com/ProtonMail/gopenpgp/v2 v2.9.0/go.mod h1:IldDyh9Hv1ZCCYatTuuEt1XZJ0OPjxLpTarDfglih7s=
+github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
+github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/brianvoe/gofakeit/v7 v7.7.3 h1:RWOATEGpJ5EVg2nN8nlaEyaV/aB4d6c3GqYrbqQekss=
+github.com/brianvoe/gofakeit/v7 v7.7.3/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cilium/ebpf v0.19.0 h1:Ro/rE64RmFBeA9FGjcTc+KmCeY6jXmryu6FfnzPRIao=
+github.com/cilium/ebpf v0.19.0/go.mod h1:fLCgMo3l8tZmAdM3B2XqdFzXBpwkcSTroaVqN08OWVY=
+github.com/cloudflare/circl v1.6.2 h1:hL7VBpHHKzrV5WTfHCaBsgx/HGbBYlgrwvNXEVDYYsQ=
+github.com/cloudflare/circl v1.6.2/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/containerd/go-cni v1.1.13 h1:eFSGOKlhoYNxpJ51KRIMHZNlg5UgocXEIEBGkY7Hnis=
+github.com/containerd/go-cni v1.1.13/go.mod h1:nTieub0XDRmvCZ9VI/SBG6PyqT95N4FIhxsauF1vSBI=
+github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo=
+github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4=
+github.com/cosi-project/runtime v1.13.0 h1:EKy/GwhVTgq131w0g3pbB0bTEf6FiZFjbK6go/I0pmE=
+github.com/cosi-project/runtime v1.13.0/go.mod h1:/9fspODJfZrO5dQatMRgN440K8DjWP1jFSgiLX+FmQc=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
+github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gertd/go-pluralize v0.2.1 h1:M3uASbVjMnTsPb0PNqg+E/24Vwigyo/tvyMTtAlLgiA=
+github.com/gertd/go-pluralize v0.2.1/go.mod h1:rbYaKDbsXxmRfr8uygAEKhOWsjyrrqrkHVpZvoOp8zk=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
+github.com/go-openapi/jsonpointer v0.22.4/go.mod h1:elX9+UgznpFhgBuaMQ7iu4lvvX1nvNsesQ3oxmYTw80=
+github.com/go-openapi/jsonreference v0.21.4 h1:24qaE2y9bx/q3uRK/qN+TDwbok1NhbSmGjjySRCHtC8=
+github.com/go-openapi/jsonreference v0.21.4/go.mod h1:rIENPTjDbLpzQmQWCj5kKj3ZlmEh+EFVbz3RTUh30/4=
+github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
+github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
+github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
+github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
+github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
+github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
+github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
+github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/cel-go v0.26.1 h1:iPbVVEdkhTX++hpe3lzSk7D3G3QSYqLGoHOcEio+UXQ=
+github.com/google/cel-go v0.26.1/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
+github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
+github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 h1:kEISI/Gx67NzH3nJxAmY/dGac80kKZgZt134u7Y/k1s=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4/go.mod h1:6Nz966r3vQYCqIzWsuEl9d7cf7mRhtDmm++sOxlnfxI=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
+github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/jsimonetti/rtnetlink/v2 v2.1.0 h1:3sSPD0k+Qvia3wbv6kZXCN0Dlz6Swv7RHjvvonuOcKE=
+github.com/jsimonetti/rtnetlink/v2 v2.1.0/go.mod h1:hPPUTE+ekH3HD+zCEGAGLxzFY9HrJCyD1aN7JJ3SHIY=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mdlayher/ethtool v0.4.0 h1:jjMGNSQfqauwFCtSzcqpa57R0AJdxKdQgbQ9mAOtM4Q=
+github.com/mdlayher/ethtool v0.4.0/go.mod h1:GrljOneAFOTPGazYlf8qpxvYLdu4mo3pdJqXWLZ2Re8=
+github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
+github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
+github.com/mdlayher/netlink v1.8.0 h1:e7XNIYJKD7hUct3Px04RuIGJbBxy1/c4nX7D5YyvvlM=
+github.com/mdlayher/netlink v1.8.0/go.mod h1:UhgKXUlDQhzb09DrCl2GuRNEglHmhYoWAHid9HK3594=
+github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
+github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
+github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
+github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
+github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/petermattis/goid v0.0.0-20251121121749-a11dd1a45f9a h1:VweslR2akb/ARhXfqSfRbj1vpWwYXf3eeAUyw/ndms0=
+github.com/petermattis/goid v0.0.0-20251121121749-a11dd1a45f9a/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/planetscale/vtprotobuf v0.6.1-0.20241121165744-79df5c4772f2 h1:1sLMdKq4gNANTj0dUibycTLzpIEKVnLnbaEkxws78nw=
+github.com/planetscale/vtprotobuf v0.6.1-0.20241121165744-79df5c4772f2/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
+github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
+github.com/sasha-s/go-deadlock v0.3.6 h1:TR7sfOnZ7x00tWPfD397Peodt57KzMDo+9Ae9rMiUmw=
+github.com/sasha-s/go-deadlock v0.3.6/go.mod h1:CUqNyyvMxTyjFqDT7MRg9mb4Dv/btmGTqSR+rky/UXo=
+github.com/siderolabs/crypto v0.6.4 h1:uMoe/X/mABOv6yOgvKcjmjIMdv6U8JegBXlPKtyjn3g=
+github.com/siderolabs/crypto v0.6.4/go.mod h1:39B7Mdrd8qTfEYOjsWPQOk7gLTWrEI30isAW+YYj9nk=
+github.com/siderolabs/gen v0.8.6 h1:pE6shuqov3L+5rEcAUJ/kY6iJofimljQw5G95P8a5c4=
+github.com/siderolabs/gen v0.8.6/go.mod h1:J9IbusbES2W6QWjtSHpDV9iPGZHc978h1+KJ4oQRspQ=
+github.com/siderolabs/go-api-signature v0.3.12 h1:i1X+kPh9fzo+lEjtEplZSbtq1p21vKv4FCWJcB/ozvk=
+github.com/siderolabs/go-api-signature v0.3.12/go.mod h1:dPLiXohup4qHX7KUgF/wwOE3lRU5uAr3ssEomNxiyxY=
+github.com/siderolabs/go-pointer v1.0.1 h1:f7Yi4IK1jptS8yrT9GEbwhmGcVxvPQgBUG/weH3V3DM=
+github.com/siderolabs/go-pointer v1.0.1/go.mod h1:C8Q/3pNHT4RE9e4rYR9PHeS6KPMlStRBgYrJQJNy/vA=
+github.com/siderolabs/go-retry v0.3.3 h1:zKV+S1vumtO72E6sYsLlmIdV/G/GcYSBLiEx/c9oCEg=
+github.com/siderolabs/go-retry v0.3.3/go.mod h1:Ff/VGc7v7un4uQg3DybgrmOWHEmJ8BzZds/XNn/BqMI=
+github.com/siderolabs/net v0.4.0 h1:1bOgVay/ijPkJz4qct98nHsiB/ysLQU0KLoBC4qLm7I=
+github.com/siderolabs/net v0.4.0/go.mod h1:/ibG+Hm9HU27agp5r9Q3eZicEfjquzNzQNux5uEk0kM=
+github.com/siderolabs/protoenc v0.2.4 h1:D3Fpn2nQSQOhl8ZlAxijZAf7K6F8CM1uZq0afIGsr8Q=
+github.com/siderolabs/protoenc v0.2.4/go.mod h1:i5XLHjfv5vyi7LhQrSEo19HCA+lYtDd7CWxsoWp9XE8=
+github.com/siderolabs/talos/pkg/machinery v1.12.0 h1:SDXXCTEuPhaXIA84WuBeG8cxR71DkF8FhXXgb2S1048=
+github.com/siderolabs/talos/pkg/machinery v1.12.0/go.mod h1:dNc4lG9yb2CzCwnJbfSUO9ZmkXE6P3BnVo1UsCITr/U=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
+github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
+github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
+go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/exp v0.0.0-20250128182459-e0ece0dbea4c h1:KL/ZBHXgKGVmuZBZ01Lt57yE5ws8ZPSkkihmEyq7FXc=
+golang.org/x/exp v0.0.0-20250128182459-e0ece0dbea4c/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
+golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b h1:uA40e2M6fYRBf0+8uN5mLlqUtV192iiksiICIBkYJ1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:Xa7le7qx2vmqB/SzWUBa7KdMjpdpAHlh5QCSnjessQk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
+google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
+google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/api v0.35.0 h1:iBAU5LTyBI9vw3L5glmat1njFK34srdLmktWwLTprlY=
+k8s.io/api v0.35.0/go.mod h1:AQ0SNTzm4ZAczM03QH42c7l3bih1TbAXYo0DkF8ktnA=
+k8s.io/apimachinery v0.35.0 h1:Z2L3IHvPVv/MJ7xRxHEtk6GoJElaAqDCCU0S6ncYok8=
+k8s.io/apimachinery v0.35.0/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/client-go v0.35.0 h1:IAW0ifFbfQQwQmga0UdoH0yvdqrbwMdq9vIFEhRpxBE=
+k8s.io/client-go v0.35.0/go.mod h1:q2E5AAyqcbeLGPdoRB+Nxe3KYTfPce1Dnu1myQdqz9o=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e h1:iW9ChlU0cU16w8MpVYjXk12dqQ4BPFBEgif+ap7/hqQ=
+k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/utils v0.0.0-20251222233032-718f0e51e6d2 h1:OfgiEo21hGiwx1oJUU5MpEaeOEg6coWndBkZF/lkFuE=
+k8s.io/utils v0.0.0-20251222233032-718f0e51e6d2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.1 h1:JrhdFMqOd/+3ByqlP2I45kTOZmTRLBUm5pvRjeheg7E=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.1/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

internal/cmd/images.go

···
+package cmd
+
+import (
+	"fmt"
+	"sort"
+
+	"github.com/evanjarrett/homelab/internal/factory"
+	"github.com/evanjarrett/homelab/internal/output"
+	"github.com/spf13/cobra"
+)
+
+func imagesCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "images [version]",
+		Short: "Generate installer image URLs for each profile",
+		Long: `Generate installer image URLs by posting schematics to the Talos Factory API.
+These URLs can be used with 'talosctl upgrade --image <URL>'.`,
+		Args: cobra.MaximumNArgs(1),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return loadConfig()
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// Get version from args or flags
+			version := ""
+			if len(args) > 0 {
+				version = args[0]
+			}
+			if version == "" {
+				var err error
+				version, err = getVersion()
+				if err != nil {
+					return err
+				}
+			}
+
+			return runImages(version)
+		},
+	}
+}
+
+func runImages(version string) error {
+	// Create factory client
+	factoryClient := factory.NewClient(cfg.Settings.FactoryBaseURL)
+	return runImagesWithClient(factoryClient, version)
+}
+
+// runImagesWithClient is the testable core of runImages
+func runImagesWithClient(factoryClient factory.FactoryClientInterface, version string) error {
+	output.Header("Installer Images for Talos v%s", version)
+	fmt.Println()
+	fmt.Println("These are the installer image URLs for 'talosctl upgrade --image <URL>'")
+	fmt.Println()
+
+	// Sort profile names for consistent output
+	var profileNames []string
+	for name := range cfg.Profiles {
+		profileNames = append(profileNames, name)
+	}
+	sort.Strings(profileNames)
+
+	for _, name := range profileNames {
+		profile := cfg.Profiles[name]
+
+		output.SubHeader("Profile: %s", name)
+
+		// Get installer image from factory API
+		output.LogInfo("Fetching schematic ID from factory...")
+		image, err := factoryClient.GetInstallerImage(profile, version)
+		if err != nil {
+			output.LogError("Failed to get image for %s: %v", name, err)
+			fmt.Println()
+			continue
+		}
+
+		fmt.Printf("  %s\n", image)
+		fmt.Println()
+
+		// Print nodes using this profile
+		nodes := cfg.GetNodesByProfile(name)
+		if len(nodes) > 0 {
+			fmt.Println("  Nodes:")
+			for _, node := range nodes {
+				fmt.Printf("    - %s (%s)\n", node.IP, node.Role)
+			}
+			fmt.Println()
+		}
+	}
+
+	return nil
+}

internal/cmd/images_test.go

···
+package cmd
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/evanjarrett/homelab/internal/factory"
+	"github.com/stretchr/testify/require"
+)
+
+// ============================================================================
+// runImagesWithClient() Tests
+// ============================================================================
+
+func TestRunImagesWithClient_SingleProfile(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {
+				Arch:       "amd64",
+				Platform:   "metal",
+				Extensions: []string{"siderolabs/i915"},
+			},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return fmt.Sprintf("factory.talos.dev/installer/abc123:v%s", version), nil
+		},
+	}
+
+	err := runImagesWithClient(factoryMock, "1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunImagesWithClient_MultipleProfiles(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"zebra-profile": {Arch: "amd64", Platform: "metal"},
+			"alpha-profile": {Arch: "arm64", Platform: "metal"},
+		},
+		Nodes: []config.Node{},
+	}
+
+	callCount := 0
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			callCount++
+			return fmt.Sprintf("factory.talos.dev/installer/schematic%d:v%s", callCount, version), nil
+		},
+	}
+
+	err := runImagesWithClient(factoryMock, "1.9.0")
+	require.NoError(t, err)
+	require.Equal(t, 2, callCount, "should call factory for each profile")
+}
+
+func TestRunImagesWithClient_FactoryError(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return "", fmt.Errorf("factory API error")
+		},
+	}
+
+	// runImagesWithClient continues on error (logs but doesn't fail)
+	err := runImagesWithClient(factoryMock, "1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunImagesWithClient_EmptyProfiles(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{},
+		Nodes:    []config.Node{},
+	}
+
+	factoryMock := &factory.MockFactoryClient{}
+
+	err := runImagesWithClient(factoryMock, "1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunImagesWithClient_WithNodes(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleControlPlane},
+			{IP: "192.168.1.2", Profile: "test-profile", Role: config.RoleWorker},
+			{IP: "192.168.1.3", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{}
+
+	err := runImagesWithClient(factoryMock, "1.9.0")
+	require.NoError(t, err)
+}

internal/cmd/root.go

···
+package cmd
+
+import (
+	"context"
+	"os"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/evanjarrett/homelab/internal/output"
+	"github.com/spf13/cobra"
+)
+
+var (
+	// Global flags
+	cfgFile      string
+	dryRun       bool
+	talosVersion string
+	preserve     bool
+
+	// Loaded config (populated in PreRunE)
+	cfg *config.Config
+
+	// Injectable for testing
+	configLoader    = config.Load
+	versionResolver = config.GetLatestTalosVersion
+)
+
+// rootCmd represents the base command
+var rootCmd = &cobra.Command{
+	Use:   "talos-upgrade",
+	Short: "Talos cluster upgrade tool",
+	Long: `A CLI tool for managing Talos Linux cluster upgrades with profile-based configurations.
+
+This tool supports:
+  - Multiple node profiles with different architectures and extensions
+  - Generating factory URLs for browser access
+  - Generating installer image URLs
+  - Upgrading nodes individually or in groups
+  - Dry-run mode for testing`,
+	SilenceUsage:  true,
+	SilenceErrors: true,
+}
+
+// Execute runs the root command
+func Execute(ctx context.Context) error {
+	return rootCmd.ExecuteContext(ctx)
+}
+
+func init() {
+	// Config file flag
+	rootCmd.PersistentFlags().StringVarP(&cfgFile, "config", "c", "",
+		"config file (default: configs/talos-profiles.yaml)")
+
+	// Dry run flag
+	rootCmd.PersistentFlags().BoolVar(&dryRun, "dry-run", false,
+		"perform a dry run without making changes")
+
+	// Version flag (not the built-in --version, this is the Talos version)
+	rootCmd.PersistentFlags().StringVarP(&talosVersion, "talos-version", "V", "",
+		"Talos version to upgrade to (default: fetch from GitHub)")
+
+	// Preserve flag
+	rootCmd.PersistentFlags().BoolVar(&preserve, "preserve", true,
+		"preserve ephemeral data during upgrade")
+
+	// Check environment variables
+	if os.Getenv("DRY_RUN") == "true" {
+		dryRun = true
+	}
+	if v := os.Getenv("TALOS_VERSION"); v != "" && talosVersion == "" {
+		talosVersion = v
+	}
+	if os.Getenv("PRESERVE") == "false" {
+		preserve = false
+	}
+
+	// Add subcommands
+	rootCmd.AddCommand(statusCmd())
+	rootCmd.AddCommand(urlsCmd())
+	rootCmd.AddCommand(imagesCmd())
+	rootCmd.AddCommand(upgradeCmd())
+	rootCmd.AddCommand(upgradeNodeCmd())
+}
+
+// loadConfig loads the configuration file
+func loadConfig() error {
+	return loadConfigWithLoader(configLoader)
+}
+
+// loadConfigWithLoader is the testable core of loadConfig
+func loadConfigWithLoader(loader func(string) (*config.Config, error)) error {
+	var err error
+	cfg, err = loader(cfgFile)
+	if err != nil {
+		return err
+	}
+	cfg.SetDefaults()
+	return nil
+}
+
+// getVersion returns the Talos version to use
+func getVersion() (string, error) {
+	return getVersionWithResolver(versionResolver)
+}
+
+// getVersionWithResolver is the testable core of getVersion
+func getVersionWithResolver(resolver func(string) (string, error)) (string, error) {
+	if talosVersion != "" {
+		return talosVersion, nil
+	}
+
+	// Fetch from GitHub
+	version, err := resolver(cfg.Settings.GithubReleasesURL)
+	if err != nil {
+		output.LogWarn("Failed to fetch latest version: %v, using fallback", err)
+		return "1.9.5", nil // Fallback version
+	}
+	return version, nil
+}

internal/cmd/root_test.go

···
+package cmd
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ============================================================================
+// getVersionWithResolver() Tests
+// ============================================================================
+
+func TestGetVersionWithResolver_FlagSet(t *testing.T) {
+	// Save and restore global state
+	originalVersion := talosVersion
+	defer func() { talosVersion = originalVersion }()
+
+	talosVersion = "1.8.0"
+
+	// Resolver should not be called when flag is set
+	resolverCalled := false
+	mockResolver := func(url string) (string, error) {
+		resolverCalled = true
+		return "1.9.0", nil
+	}
+
+	version, err := getVersionWithResolver(mockResolver)
+	require.NoError(t, err)
+	assert.Equal(t, "1.8.0", version)
+	assert.False(t, resolverCalled, "resolver should not be called when flag is set")
+}
+
+func TestGetVersionWithResolver_APISuccess(t *testing.T) {
+	// Save and restore global state
+	originalVersion := talosVersion
+	originalCfg := cfg
+	defer func() {
+		talosVersion = originalVersion
+		cfg = originalCfg
+	}()
+
+	talosVersion = "" // No flag set
+	cfg = &config.Config{
+		Settings: config.Settings{
+			GithubReleasesURL: "https://api.github.com/repos/siderolabs/talos/releases/latest",
+		},
+	}
+
+	mockResolver := func(url string) (string, error) {
+		assert.Equal(t, "https://api.github.com/repos/siderolabs/talos/releases/latest", url)
+		return "1.9.1", nil
+	}
+
+	version, err := getVersionWithResolver(mockResolver)
+	require.NoError(t, err)
+	assert.Equal(t, "1.9.1", version)
+}
+
+func TestGetVersionWithResolver_APIError_ReturnsFallback(t *testing.T) {
+	// Save and restore global state
+	originalVersion := talosVersion
+	originalCfg := cfg
+	defer func() {
+		talosVersion = originalVersion
+		cfg = originalCfg
+	}()
+
+	talosVersion = "" // No flag set
+	cfg = &config.Config{
+		Settings: config.Settings{
+			GithubReleasesURL: "https://api.github.com/repos/siderolabs/talos/releases/latest",
+		},
+	}
+
+	mockResolver := func(url string) (string, error) {
+		return "", fmt.Errorf("network error: connection refused")
+	}
+
+	version, err := getVersionWithResolver(mockResolver)
+	require.NoError(t, err) // Should not return error, uses fallback
+	assert.Equal(t, "1.9.5", version)
+}
+
+func TestGetVersionWithResolver_EmptyURLConfig(t *testing.T) {
+	// Save and restore global state
+	originalVersion := talosVersion
+	originalCfg := cfg
+	defer func() {
+		talosVersion = originalVersion
+		cfg = originalCfg
+	}()
+
+	talosVersion = "" // No flag set
+	cfg = &config.Config{
+		Settings: config.Settings{
+			GithubReleasesURL: "", // Empty URL
+		},
+	}
+
+	mockResolver := func(url string) (string, error) {
+		assert.Equal(t, "", url) // Should pass empty URL
+		return "1.9.2", nil
+	}
+
+	version, err := getVersionWithResolver(mockResolver)
+	require.NoError(t, err)
+	assert.Equal(t, "1.9.2", version)
+}
+
+// ============================================================================
+// loadConfigWithLoader() Tests
+// ============================================================================
+
+func TestLoadConfigWithLoader_Success(t *testing.T) {
+	// Save and restore global state
+	originalCfgFile := cfgFile
+	originalCfg := cfg
+	defer func() {
+		cfgFile = originalCfgFile
+		cfg = originalCfg
+	}()
+
+	cfgFile = "test-config.yaml"
+	cfg = nil
+
+	expectedConfig := &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+	}
+
+	mockLoader := func(path string) (*config.Config, error) {
+		assert.Equal(t, "test-config.yaml", path)
+		return expectedConfig, nil
+	}
+
+	err := loadConfigWithLoader(mockLoader)
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+	assert.Equal(t, "https://factory.talos.dev", cfg.Settings.FactoryBaseURL)
+}
+
+func TestLoadConfigWithLoader_Error(t *testing.T) {
+	// Save and restore global state
+	originalCfgFile := cfgFile
+	originalCfg := cfg
+	defer func() {
+		cfgFile = originalCfgFile
+		cfg = originalCfg
+	}()
+
+	cfgFile = "nonexistent.yaml"
+	cfg = nil
+
+	mockLoader := func(path string) (*config.Config, error) {
+		return nil, fmt.Errorf("config file not found: %s", path)
+	}
+
+	err := loadConfigWithLoader(mockLoader)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "config file not found")
+	assert.Nil(t, cfg)
+}
+
+func TestLoadConfigWithLoader_DefaultsApplied(t *testing.T) {
+	// Save and restore global state
+	originalCfgFile := cfgFile
+	originalCfg := cfg
+	defer func() {
+		cfgFile = originalCfgFile
+		cfg = originalCfg
+	}()
+
+	cfgFile = "test-config.yaml"
+	cfg = nil
+
+	// Return a config with empty settings to verify SetDefaults is called
+	mockLoader := func(path string) (*config.Config, error) {
+		return &config.Config{
+			Settings: config.Settings{
+				// Empty - SetDefaults should fill these
+			},
+			Profiles: map[string]config.Profile{},
+		}, nil
+	}
+
+	err := loadConfigWithLoader(mockLoader)
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+	// SetDefaults should have been called
+	assert.NotEmpty(t, cfg.Settings.FactoryBaseURL, "SetDefaults should set FactoryBaseURL")
+}

internal/cmd/status.go

···
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"sync"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/evanjarrett/homelab/internal/output"
+	"github.com/evanjarrett/homelab/internal/talos"
+	"github.com/spf13/cobra"
+)
+
+func statusCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "status",
+		Short: "Show current cluster status and node versions",
+		Long:  `Display the current status of all nodes in the cluster, including versions and reachability.`,
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return loadConfig()
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runStatus(cmd.Context())
+		},
+	}
+}
+
+func runStatus(ctx context.Context) error {
+	// Create Talos client
+	talosClient, err := talos.NewClient(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to create Talos client: %w", err)
+	}
+	defer talosClient.Close()
+
+	return runStatusWithClient(ctx, talosClient)
+}
+
+// runStatusWithClient is the testable core of runStatus
+func runStatusWithClient(ctx context.Context, client talos.TalosClientInterface) error {
+	output.Header("Talos Cluster Status")
+	fmt.Println()
+
+	// Get nodes - either from discovery or legacy config
+	nodes, err := getStatusNodes(ctx, client)
+	if err != nil {
+		return err
+	}
+
+	// Collect statuses in parallel
+	var (
+		statuses []talos.NodeStatus
+		mu       sync.Mutex
+		wg       sync.WaitGroup
+	)
+
+	for _, node := range nodes {
+		wg.Add(1)
+		go func(node statusNode) {
+			defer wg.Done()
+
+			status := client.GetNodeStatus(ctx, node.IP, node.Profile, node.Role, node.Secureboot)
+
+			mu.Lock()
+			statuses = append(statuses, status)
+			mu.Unlock()
+		}(node)
+	}
+
+	wg.Wait()
+
+	// Sort by IP (last octet)
+	sort.Slice(statuses, func(i, j int) bool {
+		return statuses[i].IP < statuses[j].IP
+	})
+
+	// Print table
+	tw := output.NewTabWriter()
+	fmt.Fprintf(tw, "NODE\tTYPE\tPROFILE\tVERSION\tSECBOOT\tSTATUS\n")
+	fmt.Fprintf(tw, "----\t----\t-------\t-------\t-------\t------\n")
+
+	for _, s := range statuses {
+		statusStr := "OK"
+		if !s.Reachable {
+			statusStr = "UNREACHABLE"
+		}
+
+		secbootStr := "no"
+		if s.Secureboot {
+			secbootStr = "yes"
+		}
+
+		statusColor := output.StatusColor(statusStr)
+		roleColor := output.RoleColor(s.Role)
+
+		fmt.Fprintf(tw, "%s\t%s\t%s\t%s\t%s\t%s\n",
+			s.IP,
+			roleColor(s.Role),
+			s.Profile,
+			s.Version,
+			secbootStr,
+			statusColor(statusStr),
+		)
+	}
+
+	tw.Flush()
+	return nil
+}
+
+// statusNode represents a node for status display
+type statusNode struct {
+	IP         string
+	Profile    string
+	Role       string
+	Secureboot bool
+}
+
+// getStatusNodes returns nodes to check, using discovery if detection is configured
+func getStatusNodes(ctx context.Context, client talos.TalosClientInterface) ([]statusNode, error) {
+	// If detection is configured, use discovery
+	if cfg.HasDetection() {
+		return discoverNodes(ctx, client)
+	}
+
+	// Fall back to legacy config nodes
+	var nodes []statusNode
+	for _, node := range cfg.Nodes {
+		profile := cfg.Profiles[node.Profile]
+		nodes = append(nodes, statusNode{
+			IP:         node.IP,
+			Profile:    node.Profile,
+			Role:       node.Role,
+			Secureboot: profile.Secureboot,
+		})
+	}
+	return nodes, nil
+}
+
+// discoverNodes uses Talos API to discover nodes and detect their profiles
+func discoverNodes(ctx context.Context, client talos.TalosClientInterface) ([]statusNode, error) {
+	// Get cluster members
+	members, err := client.GetClusterMembers(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to discover cluster members: %w", err)
+	}
+
+	var nodes []statusNode
+	for _, member := range members {
+		// Get hardware info for profile detection
+		hwInfo, err := client.GetHardwareInfo(ctx, member.IP)
+		if err != nil {
+			// If we can't get hardware info, use unknown profile
+			nodes = append(nodes, statusNode{
+				IP:         member.IP,
+				Profile:    "unknown",
+				Role:       member.Role,
+				Secureboot: false,
+			})
+			continue
+		}
+
+		// Convert to config.HardwareInfo for detection
+		cfgHwInfo := &config.HardwareInfo{
+			SystemManufacturer:    hwInfo.SystemManufacturer,
+			SystemProductName:     hwInfo.SystemProductName,
+			ProcessorManufacturer: hwInfo.ProcessorManufacturer,
+			ProcessorProductName:  hwInfo.ProcessorProductName,
+		}
+
+		// Detect profile
+		profileName, profile := cfg.DetectProfile(cfgHwInfo)
+		if profile == nil {
+			profileName = "unknown"
+		}
+
+		secureboot := false
+		if profile != nil {
+			secureboot = profile.Secureboot
+		}
+
+		nodes = append(nodes, statusNode{
+			IP:         member.IP,
+			Profile:    profileName,
+			Role:       member.Role,
+			Secureboot: secureboot,
+		})
+	}
+
+	return nodes, nil
+}

internal/cmd/status_test.go

···
+package cmd
+
+import (
+	"context"
+	"sync"
+	"testing"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/evanjarrett/homelab/internal/talos"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ============================================================================
+// runStatusWithClient() Tests
+// ============================================================================
+
+func TestRunStatusWithClient_AllNodesReachable(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 600,
+		},
+		Profiles: map[string]config.Profile{
+			"profile-a": {Arch: "amd64", Platform: "metal", Secureboot: false},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleControlPlane},
+			{IP: "192.168.1.2", Profile: "profile-a", Role: config.RoleWorker},
+		},
+	}
+
+	mock := &talos.MockClient{
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			return talos.NodeStatus{
+				IP:         nodeIP,
+				Profile:    profile,
+				Role:       role,
+				Version:    "1.9.0",
+				Reachable:  true,
+				Secureboot: secureboot,
+			}
+		},
+	}
+
+	err := runStatusWithClient(context.Background(), mock)
+	require.NoError(t, err)
+}
+
+func TestRunStatusWithClient_SomeNodesUnreachable(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 600,
+		},
+		Profiles: map[string]config.Profile{
+			"profile-a": {Arch: "amd64", Platform: "metal", Secureboot: false},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleControlPlane},
+			{IP: "192.168.1.2", Profile: "profile-a", Role: config.RoleWorker},
+		},
+	}
+
+	mock := &talos.MockClient{
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			reachable := nodeIP == "192.168.1.1" // Only first node is reachable
+			version := "1.9.0"
+			if !reachable {
+				version = "N/A"
+			}
+			return talos.NodeStatus{
+				IP:         nodeIP,
+				Profile:    profile,
+				Role:       role,
+				Version:    version,
+				Reachable:  reachable,
+				Secureboot: secureboot,
+			}
+		},
+	}
+
+	err := runStatusWithClient(context.Background(), mock)
+	require.NoError(t, err)
+}
+
+func TestRunStatusWithClient_MixedRoles(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 600,
+		},
+		Profiles: map[string]config.Profile{
+			"profile-a": {Arch: "amd64", Platform: "metal", Secureboot: false},
+			"profile-b": {Arch: "arm64", Platform: "metal", Secureboot: true},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleControlPlane},
+			{IP: "192.168.1.2", Profile: "profile-a", Role: config.RoleWorker},
+			{IP: "192.168.1.3", Profile: "profile-b", Role: config.RoleControlPlane},
+			{IP: "192.168.1.4", Profile: "profile-b", Role: config.RoleWorker},
+		},
+	}
+
+	var mu sync.Mutex
+	calledWith := make(map[string]bool)
+	mock := &talos.MockClient{
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			mu.Lock()
+			calledWith[nodeIP] = true
+			mu.Unlock()
+			return talos.NodeStatus{
+				IP:         nodeIP,
+				Profile:    profile,
+				Role:       role,
+				Version:    "1.9.0",
+				Reachable:  true,
+				Secureboot: secureboot,
+			}
+		},
+	}
+
+	err := runStatusWithClient(context.Background(), mock)
+	require.NoError(t, err)
+
+	// All nodes should have been queried
+	assert.True(t, calledWith["192.168.1.1"])
+	assert.True(t, calledWith["192.168.1.2"])
+	assert.True(t, calledWith["192.168.1.3"])
+	assert.True(t, calledWith["192.168.1.4"])
+}
+
+func TestRunStatusWithClient_SecurebootIndicators(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 600,
+		},
+		Profiles: map[string]config.Profile{
+			"secureboot":    {Arch: "amd64", Platform: "metal", Secureboot: true},
+			"no-secureboot": {Arch: "amd64", Platform: "metal", Secureboot: false},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "secureboot", Role: config.RoleControlPlane},
+			{IP: "192.168.1.2", Profile: "no-secureboot", Role: config.RoleWorker},
+		},
+	}
+
+	var mu sync.Mutex
+	securebootNodes := make(map[string]bool)
+	mock := &talos.MockClient{
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			mu.Lock()
+			securebootNodes[nodeIP] = secureboot
+			mu.Unlock()
+			return talos.NodeStatus{
+				IP:         nodeIP,
+				Profile:    profile,
+				Role:       role,
+				Version:    "1.9.0",
+				Reachable:  true,
+				Secureboot: secureboot,
+			}
+		},
+	}
+
+	err := runStatusWithClient(context.Background(), mock)
+	require.NoError(t, err)
+
+	// Verify correct secureboot values were passed
+	assert.True(t, securebootNodes["192.168.1.1"], "secureboot profile should have secureboot=true")
+	assert.False(t, securebootNodes["192.168.1.2"], "no-secureboot profile should have secureboot=false")
+}
+
+func TestRunStatusWithClient_EmptyConfig(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 600,
+		},
+		Profiles: map[string]config.Profile{},
+		Nodes:    []config.Node{},
+	}
+
+	mock := &talos.MockClient{}
+
+	err := runStatusWithClient(context.Background(), mock)
+	require.NoError(t, err)
+}

internal/cmd/upgrade.go

···
+package cmd
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/evanjarrett/homelab/internal/factory"
+	"github.com/evanjarrett/homelab/internal/output"
+	"github.com/evanjarrett/homelab/internal/talos"
+	"github.com/spf13/cobra"
+)
+
+// internalExtensions are system-level extensions that should be ignored during comparison
+var internalExtensions = map[string]bool{
+	"schematic":   true, // Virtual extension from Image Factory
+	"modules.dep": true, // Combined modules.dep for all extensions
+}
+
+// UpgradeRequest contains all information needed to upgrade a node
+type UpgradeRequest struct {
+	Node               config.Node
+	Image              string   // Full installer image URL
+	Version            string   // Target Talos version
+	ExpectedExtensions []string // Extensions from profile
+	ExpectedKernelArgs []string // Kernel args from profile
+}
+
+// extensionsDiffer compares running extensions with expected extensions from the profile.
+// Returns true if there's a difference (upgrade needed), false otherwise.
+// Also returns a description of the difference.
+func extensionsDiffer(running []talos.ExtensionInfo, expected []string) (bool, string) {
+	// Build a set of running extension names (excluding internal extensions)
+	runningNames := make(map[string]bool)
+	for _, ext := range running {
+		if !internalExtensions[ext.Name] {
+			runningNames[ext.Name] = true
+		}
+	}
+
+	// Build a set of expected extension names (strip siderolabs/ prefix)
+	expectedNames := make(map[string]bool)
+	for _, ext := range expected {
+		name := ext
+		// Strip vendor prefix (e.g., "siderolabs/gasket-driver" -> "gasket-driver")
+		if idx := strings.LastIndex(ext, "/"); idx >= 0 {
+			name = ext[idx+1:]
+		}
+		expectedNames[name] = true
+	}
+
+	// Find missing (expected but not running)
+	var missing []string
+	for name := range expectedNames {
+		if !runningNames[name] {
+			missing = append(missing, name)
+		}
+	}
+
+	// Find extra (running but not expected)
+	var extra []string
+	for name := range runningNames {
+		if !expectedNames[name] {
+			extra = append(extra, name)
+		}
+	}
+
+	if len(missing) == 0 && len(extra) == 0 {
+		return false, ""
+	}
+
+	var parts []string
+	if len(missing) > 0 {
+		sort.Strings(missing)
+		parts = append(parts, fmt.Sprintf("missing: %s", strings.Join(missing, ", ")))
+	}
+	if len(extra) > 0 {
+		sort.Strings(extra)
+		parts = append(parts, fmt.Sprintf("extra: %s", strings.Join(extra, ", ")))
+	}
+
+	return true, strings.Join(parts, "; ")
+}
+
+// kernelArgsDiffer compares running kernel cmdline with expected kernel args from the profile.
+// Returns true if there's a difference (upgrade needed), false otherwise.
+// Also returns a description of the difference.
+func kernelArgsDiffer(cmdline string, expected []string) (bool, string) {
+	if len(expected) == 0 {
+		return false, ""
+	}
+
+	// Split cmdline into individual args
+	cmdlineArgs := strings.Fields(cmdline)
+	cmdlineSet := make(map[string]bool)
+	for _, arg := range cmdlineArgs {
+		cmdlineSet[arg] = true
+	}
+
+	// Find missing kernel args
+	var missing []string
+	for _, arg := range expected {
+		if !cmdlineSet[arg] {
+			missing = append(missing, arg)
+		}
+	}
+
+	if len(missing) == 0 {
+		return false, ""
+	}
+
+	sort.Strings(missing)
+	return true, fmt.Sprintf("missing kernel args: %s", strings.Join(missing, ", "))
+}
+
+func upgradeCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "upgrade [target] [version]",
+		Short: "Upgrade nodes to specified version",
+		Long: `Upgrade nodes to specified version.
+
+Target can be:
+  all          - All nodes (workers first, then control planes)
+  workers      - Worker nodes only
+  controlplanes - Control plane nodes only
+  <profile>    - Nodes matching a specific profile
+  <ip>         - A single node by IP address
+
+Arguments can be in either order:
+  upgrade 1.9.5 workers
+  upgrade workers 1.9.5`,
+		Args: cobra.MaximumNArgs(2),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return loadConfig()
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			target, version := parseUpgradeArgs(args)
+			return runUpgrade(cmd.Context(), target, version)
+		},
+	}
+}
+
+// parseUpgradeArgs handles flexible argument ordering
+func parseUpgradeArgs(args []string) (target, version string) {
+	target = "all"
+	version = ""
+
+	if len(args) == 0 {
+		return
+	}
+
+	// Check if first arg looks like a version (starts with digit)
+	if len(args) >= 1 {
+		if isVersion(args[0]) {
+			version = args[0]
+			if len(args) >= 2 {
+				target = args[1]
+			}
+		} else {
+			target = args[0]
+			if len(args) >= 2 {
+				version = args[1]
+			}
+		}
+	}
+
+	return
+}
+
+// isVersion checks if a string looks like a version number (e.g., 1.12.0)
+func isVersion(s string) bool {
+	if len(s) == 0 {
+		return false
+	}
+	// Must start with a digit
+	if s[0] < '0' || s[0] > '9' {
+		return false
+	}
+	// Count dots - versions have 2 dots (X.Y.Z), IPs have 3 dots (A.B.C.D)
+	dots := 0
+	for _, c := range s {
+		if c == '.' {
+			dots++
+		}
+	}
+	// Version: 1.12.0 (2 dots), IP: 192.168.1.1 (3 dots)
+	return dots <= 2
+}
+
+func runUpgrade(ctx context.Context, target, version string) error {
+	// Get version if not specified
+	if version == "" {
+		var err error
+		version, err = getVersion()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Create clients
+	talosClient, err := talos.NewClient(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to create Talos client: %w", err)
+	}
+	defer talosClient.Close()
+
+	factoryClient := factory.NewClient(cfg.Settings.FactoryBaseURL)
+
+	return runUpgradeWithClients(ctx, talosClient, factoryClient, target, version)
+}
+
+// runUpgradeWithClients is the testable core of runUpgrade
+func runUpgradeWithClients(ctx context.Context, talosClient talos.TalosClientInterface,
+	factoryClient factory.FactoryClientInterface, target, version string) error {
+
+	output.Header("Talos Cluster Upgrade to v%s", version)
+	fmt.Println()
+
+	if dryRun {
+		output.LogWarn("DRY RUN MODE - No changes will be made")
+		fmt.Println()
+	}
+
+	// Build list of nodes to upgrade (uses discovery if detection is configured)
+	nodes, err := getUpgradeNodes(ctx, talosClient, target)
+	if err != nil {
+		return err
+	}
+
+	if len(nodes) == 0 {
+		output.LogError("No nodes found to upgrade for target: %s", target)
+		return fmt.Errorf("no nodes found")
+	}
+
+	// Sort nodes by IP
+	sort.Slice(nodes, func(i, j int) bool {
+		return nodes[i].IP < nodes[j].IP
+	})
+
+	// Print nodes to upgrade
+	fmt.Println("Nodes to upgrade (in order):")
+	for _, node := range nodes {
+		fmt.Printf("  - %s (%s, profile: %s)\n", node.IP, node.Role, node.Profile)
+	}
+	fmt.Println()
+
+	// Confirm unless dry run
+	if !dryRun {
+		if !confirm("Proceed with upgrade?") {
+			fmt.Println("Aborted.")
+			return nil
+		}
+	}
+
+	// Get installer images for each profile (cache them)
+	profileImages := make(map[string]string)
+	profilesNeeded := make(map[string]bool)
+	for _, node := range nodes {
+		profilesNeeded[node.Profile] = true
+	}
+
+	for profileName := range profilesNeeded {
+		profile := cfg.Profiles[profileName]
+		output.LogInfo("Getting installer image for profile %s...", profileName)
+
+		image, err := factoryClient.GetInstallerImage(profile, version)
+		if err != nil {
+			return fmt.Errorf("failed to get image for profile %s: %w", profileName, err)
+		}
+
+		profileImages[profileName] = image
+		output.LogSuccess("  %s", image)
+	}
+	fmt.Println()
+
+	// Upgrade nodes one by one
+	var failedNodes []string
+	var skippedNodes []string
+	for _, node := range nodes {
+		image := profileImages[node.Profile]
+		profile := cfg.Profiles[node.Profile]
+
+		fmt.Println()
+		output.Separator()
+
+		req := UpgradeRequest{
+			Node:               node,
+			Image:              image,
+			Version:            version,
+			ExpectedExtensions: profile.Extensions,
+			ExpectedKernelArgs: profile.KernelArgs,
+		}
+		skipped, err := upgradeNode(ctx, talosClient, req)
+		if err != nil {
+			failedNodes = append(failedNodes, node.IP)
+			output.LogError("Failed to upgrade %s: %v", node.IP, err)
+
+			// For control plane failures, ask before continuing
+			if node.Role == config.RoleControlPlane && !dryRun {
+				if !confirm("Control plane upgrade failed. Continue?") {
+					break
+				}
+			}
+		} else if skipped {
+			skippedNodes = append(skippedNodes, node.IP)
+		}
+	}
+
+	// Summary
+	fmt.Println()
+	output.Separator()
+	output.Header("Upgrade Summary")
+	fmt.Println()
+
+	if len(skippedNodes) > 0 {
+		output.LogInfo("Skipped (already at target): %s", strings.Join(skippedNodes, ", "))
+	}
+	if len(failedNodes) > 0 {
+		output.LogError("Failed nodes: %s", strings.Join(failedNodes, ", "))
+	}
+	if len(failedNodes) == 0 {
+		output.LogSuccess("All nodes upgraded successfully!")
+	}
+
+	// Show final status
+	fmt.Println()
+	return runStatusWithClient(ctx, talosClient)
+}
+
+// getNodesForTarget returns the list of nodes matching the target (legacy config)
+func getNodesForTarget(target string) ([]config.Node, error) {
+	switch target {
+	case "all":
+		return cfg.GetAllNodesOrdered(), nil
+	case "workers":
+		return cfg.GetWorkerNodes(), nil
+	case "controlplanes":
+		return cfg.GetControlPlaneNodes(), nil
+	default:
+		// Check if it's a node IP
+		if node := cfg.GetNodeByIP(target); node != nil {
+			return []config.Node{*node}, nil
+		}
+
+		// Check if it's a profile name
+		nodes := cfg.GetNodesByProfile(target)
+		if len(nodes) > 0 {
+			return nodes, nil
+		}
+
+		return nil, fmt.Errorf("unknown target: %s", target)
+	}
+}
+
+// getUpgradeNodes returns nodes for upgrade, using discovery if detection is configured
+func getUpgradeNodes(ctx context.Context, client talos.TalosClientInterface, target string) ([]config.Node, error) {
+	// If detection is configured, use discovery
+	if cfg.HasDetection() {
+		return discoverUpgradeNodes(ctx, client, target)
+	}
+
+	// Fall back to legacy config
+	return getNodesForTarget(target)
+}
+
+// discoverUpgradeNodes discovers nodes and builds config.Node structs with detected profiles
+func discoverUpgradeNodes(ctx context.Context, client talos.TalosClientInterface, target string) ([]config.Node, error) {
+	// Get cluster members
+	members, err := client.GetClusterMembers(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to discover cluster members: %w", err)
+	}
+
+	var nodes []config.Node
+	for _, member := range members {
+		// Get hardware info for profile detection
+		hwInfo, err := client.GetHardwareInfo(ctx, member.IP)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get hardware info for %s: %w", member.IP, err)
+		}
+
+		// Convert to config.HardwareInfo for detection
+		cfgHwInfo := &config.HardwareInfo{
+			SystemManufacturer:    hwInfo.SystemManufacturer,
+			SystemProductName:     hwInfo.SystemProductName,
+			ProcessorManufacturer: hwInfo.ProcessorManufacturer,
+			ProcessorProductName:  hwInfo.ProcessorProductName,
+		}
+
+		// Detect profile
+		profileName, profile := cfg.DetectProfile(cfgHwInfo)
+		if profile == nil {
+			return nil, fmt.Errorf("no profile detected for node %s (hw: %+v)", member.IP, cfgHwInfo)
+		}
+
+		nodes = append(nodes, config.Node{
+			IP:      member.IP,
+			Profile: profileName,
+			Role:    member.Role,
+		})
+	}
+
+	// Filter by target
+	return filterNodesByTarget(nodes, target)
+}
+
+// filterNodesByTarget filters nodes based on target (all, workers, controlplanes, profile, IP)
+func filterNodesByTarget(nodes []config.Node, target string) ([]config.Node, error) {
+	switch target {
+	case "all":
+		// Order: workers first, then control planes
+		var workers, controlplanes []config.Node
+		for _, node := range nodes {
+			if node.Role == config.RoleWorker {
+				workers = append(workers, node)
+			} else {
+				controlplanes = append(controlplanes, node)
+			}
+		}
+		return append(workers, controlplanes...), nil
+
+	case "workers":
+		var filtered []config.Node
+		for _, node := range nodes {
+			if node.Role == config.RoleWorker {
+				filtered = append(filtered, node)
+			}
+		}
+		return filtered, nil
+
+	case "controlplanes":
+		var filtered []config.Node
+		for _, node := range nodes {
+			if node.Role == config.RoleControlPlane {
+				filtered = append(filtered, node)
+			}
+		}
+		return filtered, nil
+
+	default:
+		// Check if it's a node IP
+		for _, node := range nodes {
+			if node.IP == target {
+				return []config.Node{node}, nil
+			}
+		}
+
+		// Check if it's a profile name
+		var filtered []config.Node
+		for _, node := range nodes {
+			if node.Profile == target {
+				filtered = append(filtered, node)
+			}
+		}
+		if len(filtered) > 0 {
+			return filtered, nil
+		}
+
+		return nil, fmt.Errorf("unknown target: %s", target)
+	}
+}
+
+// upgradeNode upgrades a single node
+// Returns (skipped, error) - skipped is true if node was already at target version/extensions/kernel args
+func upgradeNode(ctx context.Context, client talos.TalosClientInterface, req UpgradeRequest) (bool, error) {
+	// Get current version
+	currentVersion, err := client.GetVersion(ctx, req.Node.IP)
+	if err != nil {
+		currentVersion = "unknown"
+	}
+
+	// Get current extensions
+	currentExtensions, err := client.GetExtensions(ctx, req.Node.IP)
+	if err != nil {
+		// Non-fatal: we'll just assume extensions differ
+		currentExtensions = nil
+	}
+
+	// Get current kernel cmdline
+	currentCmdline, err := client.GetKernelCmdline(ctx, req.Node.IP)
+	if err != nil {
+		// Non-fatal: we'll just assume kernel args differ
+		currentCmdline = ""
+	}
+
+	// Check if extensions differ
+	extDiffer, extDiff := extensionsDiffer(currentExtensions, req.ExpectedExtensions)
+
+	// Check if kernel args differ
+	kaDiffer, kaDiff := kernelArgsDiffer(currentCmdline, req.ExpectedKernelArgs)
+
+	// Skip if already at target version AND extensions match AND kernel args match
+	if currentVersion == req.Version && !extDiffer && !kaDiffer {
+		output.LogSuccess("Node %s already at v%s with matching config, skipping", req.Node.IP, req.Version)
+		return true, nil
+	}
+
+	output.LogInfo("Upgrading node %s (%s)", req.Node.IP, req.Node.Role)
+	output.LogInfo("  Current version: %s", currentVersion)
+	if extDiffer {
+		output.LogInfo("  Extensions differ: %s", extDiff)
+	}
+	if kaDiffer {
+		output.LogInfo("  Kernel args differ: %s", kaDiff)
+	}
+	output.LogInfo("  Target image: %s", req.Image)
+
+	if dryRun {
+		output.LogWarn("DRY RUN: Would run: talosctl upgrade -n %s --image %s --preserve=%v",
+			req.Node.IP, req.Image, preserve)
+		return false, nil
+	}
+
+	// Run upgrade
+	if err := client.Upgrade(ctx, req.Node.IP, req.Image, preserve); err != nil {
+		return false, fmt.Errorf("upgrade command failed: %w", err)
+	}
+
+	// Watch upgrade progress with streaming events
+	output.LogInfo("Watching upgrade progress...")
+	timeout := time.Duration(cfg.Settings.DefaultTimeoutSeconds) * time.Second
+
+	var lastPhase, lastTask string
+	err = client.WatchUpgrade(ctx, req.Node.IP, timeout, func(p talos.UpgradeProgress) {
+		// Show stage changes
+		if p.Stage != "" {
+			output.LogInfo("  [%s]", p.Stage)
+		}
+		// Show phase changes (avoid duplicates)
+		if p.Phase != "" && p.Phase != lastPhase {
+			lastPhase = p.Phase
+			output.LogInfo("    phase: %s (%s)", p.Phase, p.Action)
+		}
+		// Show task changes (avoid duplicates)
+		if p.Task != "" && p.Task != lastTask {
+			lastTask = p.Task
+			output.LogInfo("      task: %s (%s)", p.Task, p.Action)
+		}
+	})
+	if err != nil {
+		return false, fmt.Errorf("upgrade failed: %w", err)
+	}
+
+	// Wait for critical services to be healthy
+	var services []string
+	if req.Node.Role == config.RoleControlPlane {
+		services = talos.GetControlPlaneServices()
+	} else {
+		services = talos.GetWorkerServices()
+	}
+	output.LogInfo("Waiting for Talos services: %v", services)
+	if err := client.WaitForServices(ctx, req.Node.IP, services, 60*time.Second); err != nil {
+		output.LogWarn("Services health check timed out: %v", err)
+	} else {
+		output.LogSuccess("Talos services healthy")
+	}
+
+	// For control plane nodes, also wait for K8s static pods
+	if req.Node.Role == config.RoleControlPlane {
+		output.LogInfo("Waiting for K8s control plane pods: apiserver, controller-manager, scheduler")
+		if err := client.WaitForStaticPods(ctx, req.Node.IP, 90*time.Second); err != nil {
+			output.LogWarn("Static pods health check timed out: %v", err)
+		} else {
+			output.LogSuccess("K8s control plane pods healthy")
+		}
+	}
+
+	// Verify new version
+	newVersion, err := client.GetVersion(ctx, req.Node.IP)
+	if err != nil {
+		newVersion = "unknown"
+	}
+
+	output.LogSuccess("Node %s upgraded: %s -> %s", req.Node.IP, currentVersion, newVersion)
+	return false, nil
+}
+
+// confirmReader is the reader used for confirmation prompts (can be replaced in tests)
+var confirmReader io.Reader = os.Stdin
+
+// confirm asks the user for confirmation
+func confirm(prompt string) bool {
+	reader := bufio.NewReader(confirmReader)
+	fmt.Printf("%s [y/N] ", prompt)
+
+	response, err := reader.ReadString('\n')
+	if err != nil {
+		return false
+	}
+
+	response = strings.TrimSpace(strings.ToLower(response))
+	return response == "y" || response == "yes"
+}

internal/cmd/upgrade_node.go

···
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/evanjarrett/homelab/internal/factory"
+	"github.com/evanjarrett/homelab/internal/output"
+	"github.com/evanjarrett/homelab/internal/talos"
+	"github.com/spf13/cobra"
+)
+
+func upgradeNodeCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "upgrade-node <ip> [version]",
+		Short: "Upgrade a single node",
+		Long:  `Upgrade a single node by IP address to the specified version.`,
+		Args:  cobra.RangeArgs(1, 2),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return loadConfig()
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			nodeIP := args[0]
+			version := ""
+			if len(args) > 1 {
+				version = args[1]
+			}
+			return runUpgradeNode(cmd.Context(), nodeIP, version)
+		},
+	}
+}
+
+func runUpgradeNode(ctx context.Context, nodeIP, version string) error {
+	// Get version if not specified
+	if version == "" {
+		var err error
+		version, err = getVersion()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Create clients
+	talosClient, err := talos.NewClient(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to create Talos client: %w", err)
+	}
+	defer talosClient.Close()
+
+	factoryClient := factory.NewClient(cfg.Settings.FactoryBaseURL)
+
+	return runUpgradeNodeWithClients(ctx, talosClient, factoryClient, nodeIP, version)
+}
+
+// runUpgradeNodeWithClients is the testable core of runUpgradeNode
+func runUpgradeNodeWithClients(ctx context.Context, talosClient talos.TalosClientInterface,
+	factoryClient factory.FactoryClientInterface, nodeIP, version string) error {
+
+	// Get or detect the node and profile
+	node, profile, profileName, err := getNodeAndProfile(ctx, talosClient, nodeIP)
+	if err != nil {
+		return err
+	}
+
+	output.Header("Upgrading node %s to v%s", nodeIP, version)
+	fmt.Println()
+
+	if dryRun {
+		output.LogWarn("DRY RUN MODE - No changes will be made")
+		fmt.Println()
+	}
+
+	// Get installer image
+	output.LogInfo("Getting installer image for profile %s...", profileName)
+	image, err := factoryClient.GetInstallerImage(*profile, version)
+	if err != nil {
+		return fmt.Errorf("failed to get image: %w", err)
+	}
+	output.LogSuccess("  %s", image)
+	fmt.Println()
+
+	// Run upgrade
+	req := UpgradeRequest{
+		Node:               *node,
+		Image:              image,
+		Version:            version,
+		ExpectedExtensions: profile.Extensions,
+		ExpectedKernelArgs: profile.KernelArgs,
+	}
+	_, err = upgradeNode(ctx, talosClient, req)
+	return err
+}
+
+// getNodeAndProfile returns the node and profile for an IP, using detection if available
+func getNodeAndProfile(ctx context.Context, client talos.TalosClientInterface, nodeIP string) (*config.Node, *config.Profile, string, error) {
+	// Try legacy config first
+	if node := cfg.GetNodeByIP(nodeIP); node != nil {
+		profile, ok := cfg.Profiles[node.Profile]
+		if !ok {
+			return nil, nil, "", fmt.Errorf("unknown profile: %s", node.Profile)
+		}
+		return node, &profile, node.Profile, nil
+	}
+
+	// If detection is configured, try to detect
+	if cfg.HasDetection() {
+		hwInfo, err := client.GetHardwareInfo(ctx, nodeIP)
+		if err != nil {
+			return nil, nil, "", fmt.Errorf("failed to get hardware info for %s: %w", nodeIP, err)
+		}
+
+		// Convert to config.HardwareInfo for detection
+		cfgHwInfo := &config.HardwareInfo{
+			SystemManufacturer:    hwInfo.SystemManufacturer,
+			SystemProductName:     hwInfo.SystemProductName,
+			ProcessorManufacturer: hwInfo.ProcessorManufacturer,
+			ProcessorProductName:  hwInfo.ProcessorProductName,
+		}
+
+		profileName, profile := cfg.DetectProfile(cfgHwInfo)
+		if profile == nil {
+			return nil, nil, "", fmt.Errorf("no profile detected for node %s", nodeIP)
+		}
+
+		// Get role from cluster members
+		members, err := client.GetClusterMembers(ctx)
+		if err != nil {
+			return nil, nil, "", fmt.Errorf("failed to get cluster members: %w", err)
+		}
+
+		role := config.RoleWorker
+		for _, member := range members {
+			if member.IP == nodeIP {
+				role = member.Role
+				break
+			}
+		}
+
+		node := &config.Node{
+			IP:      nodeIP,
+			Profile: profileName,
+			Role:    role,
+		}
+		return node, profile, profileName, nil
+	}
+
+	return nil, nil, "", fmt.Errorf("unknown node: %s", nodeIP)
+}

internal/cmd/upgrade_node_test.go

···
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/evanjarrett/homelab/internal/factory"
+	"github.com/evanjarrett/homelab/internal/talos"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ============================================================================
+// runUpgradeNodeWithClients() Tests
+// ============================================================================
+
+func TestRunUpgradeNodeWithClients_Success(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = false
+	preserve = true
+
+	talosMock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			return nil
+		},
+		WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, cb talos.ProgressCallback) error {
+			return nil
+		},
+		WaitForServicesFunc: func(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+			return nil
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return fmt.Sprintf("factory.talos.dev/installer/test:v%s", version), nil
+		},
+	}
+
+	err := runUpgradeNodeWithClients(context.Background(), talosMock, factoryMock, "192.168.1.1", "1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunUpgradeNodeWithClients_UnknownNode(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+
+	talosMock := &talos.MockClient{}
+	factoryMock := &factory.MockFactoryClient{}
+
+	err := runUpgradeNodeWithClients(context.Background(), talosMock, factoryMock, "192.168.1.99", "1.9.0")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown node")
+}
+
+func TestRunUpgradeNodeWithClients_UnknownProfile(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"other-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "missing-profile", Role: config.RoleWorker},
+		},
+	}
+
+	talosMock := &talos.MockClient{}
+	factoryMock := &factory.MockFactoryClient{}
+
+	err := runUpgradeNodeWithClients(context.Background(), talosMock, factoryMock, "192.168.1.1", "1.9.0")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown profile")
+}
+
+func TestRunUpgradeNodeWithClients_FactoryError(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+
+	talosMock := &talos.MockClient{}
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return "", fmt.Errorf("factory API error: connection refused")
+		},
+	}
+
+	err := runUpgradeNodeWithClients(context.Background(), talosMock, factoryMock, "192.168.1.1", "1.9.0")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to get image")
+}
+
+func TestRunUpgradeNodeWithClients_DryRun(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = true
+	preserve = true
+	defer func() { dryRun = false }()
+
+	upgradeWasCalled := false
+	talosMock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			upgradeWasCalled = true
+			return nil
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{}
+
+	err := runUpgradeNodeWithClients(context.Background(), talosMock, factoryMock, "192.168.1.1", "1.9.0")
+	require.NoError(t, err)
+	assert.False(t, upgradeWasCalled, "upgrade should not be called in dry run mode")
+}

internal/cmd/upgrade_test.go

···
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/evanjarrett/homelab/internal/factory"
+	"github.com/evanjarrett/homelab/internal/talos"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ============================================================================
+// isVersion() Tests
+// ============================================================================
+
+func TestIsVersion_ValidVersions(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected bool
+	}{
+		{"1.7.0", true},
+		{"1.12.0", true},
+		{"2.0.0", true},
+		{"1.7", true}, // Two-part version
+		{"1", true},   // Single number
+		{"10.20.30", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			result := isVersion(tt.input)
+			assert.Equal(t, tt.expected, result, "isVersion(%q)", tt.input)
+		})
+	}
+}
+
+func TestIsVersion_IPAddresses(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected bool
+	}{
+		{"192.168.1.1", false}, // 3 dots = IP
+		{"192.168.1.123", false},
+		{"10.0.0.1", false},
+		{"172.16.0.100", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			result := isVersion(tt.input)
+			assert.Equal(t, tt.expected, result, "isVersion(%q) should detect IP", tt.input)
+		})
+	}
+}
+
+func TestIsVersion_InvalidInputs(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected bool
+	}{
+		{"", false},        // Empty string
+		{"all", false},     // Target keyword
+		{"workers", false}, // Target keyword
+		{"controlplanes", false},
+		{"v1.7.0", false}, // Starts with letter
+		{"profile-name", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			result := isVersion(tt.input)
+			assert.Equal(t, tt.expected, result, "isVersion(%q)", tt.input)
+		})
+	}
+}
+
+// ============================================================================
+// parseUpgradeArgs() Tests
+// ============================================================================
+
+func TestParseUpgradeArgs_NoArgs(t *testing.T) {
+	target, version := parseUpgradeArgs([]string{})
+	assert.Equal(t, "all", target)
+	assert.Empty(t, version)
+}
+
+func TestParseUpgradeArgs_VersionOnly(t *testing.T) {
+	target, version := parseUpgradeArgs([]string{"1.7.0"})
+	assert.Equal(t, "all", target)
+	assert.Equal(t, "1.7.0", version)
+}
+
+func TestParseUpgradeArgs_TargetOnly(t *testing.T) {
+	target, version := parseUpgradeArgs([]string{"workers"})
+	assert.Equal(t, "workers", target)
+	assert.Empty(t, version)
+}
+
+func TestParseUpgradeArgs_VersionThenTarget(t *testing.T) {
+	// Version comes first
+	target, version := parseUpgradeArgs([]string{"1.7.0", "workers"})
+	assert.Equal(t, "workers", target)
+	assert.Equal(t, "1.7.0", version)
+}
+
+func TestParseUpgradeArgs_TargetThenVersion(t *testing.T) {
+	// Target comes first
+	target, version := parseUpgradeArgs([]string{"workers", "1.7.0"})
+	assert.Equal(t, "workers", target)
+	assert.Equal(t, "1.7.0", version)
+}
+
+func TestParseUpgradeArgs_IPAsTarget(t *testing.T) {
+	// IP address should be recognized as target, not version
+	target, version := parseUpgradeArgs([]string{"192.168.1.123"})
+	assert.Equal(t, "192.168.1.123", target)
+	assert.Empty(t, version)
+}
+
+func TestParseUpgradeArgs_VersionAndIP(t *testing.T) {
+	// Version first, then IP
+	target, version := parseUpgradeArgs([]string{"1.7.0", "192.168.1.123"})
+	assert.Equal(t, "192.168.1.123", target)
+	assert.Equal(t, "1.7.0", version)
+}
+
+func TestParseUpgradeArgs_IPAndVersion(t *testing.T) {
+	// IP first, then version
+	target, version := parseUpgradeArgs([]string{"192.168.1.123", "1.7.0"})
+	assert.Equal(t, "192.168.1.123", target)
+	assert.Equal(t, "1.7.0", version)
+}
+
+func TestParseUpgradeArgs_ProfileTarget(t *testing.T) {
+	target, version := parseUpgradeArgs([]string{"arm64-rpi", "1.8.0"})
+	assert.Equal(t, "arm64-rpi", target)
+	assert.Equal(t, "1.8.0", version)
+}
+
+// ============================================================================
+// getNodesForTarget() Tests
+// ============================================================================
+
+func setupTestConfig() {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 600,
+		},
+		Profiles: map[string]config.Profile{
+			"profile-a": {Arch: "amd64", Platform: "metal"},
+			"profile-b": {Arch: "arm64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleControlPlane},
+			{IP: "192.168.1.2", Profile: "profile-a", Role: config.RoleWorker},
+			{IP: "192.168.1.3", Profile: "profile-b", Role: config.RoleWorker},
+			{IP: "192.168.1.4", Profile: "profile-b", Role: config.RoleControlPlane},
+		},
+	}
+}
+
+func TestGetNodesForTarget_All(t *testing.T) {
+	setupTestConfig()
+
+	nodes, err := getNodesForTarget("all")
+	require.NoError(t, err)
+	assert.Len(t, nodes, 4)
+
+	// Workers should come first (GetAllNodesOrdered)
+	assert.Equal(t, config.RoleWorker, nodes[0].Role)
+	assert.Equal(t, config.RoleWorker, nodes[1].Role)
+	assert.Equal(t, config.RoleControlPlane, nodes[2].Role)
+	assert.Equal(t, config.RoleControlPlane, nodes[3].Role)
+}
+
+func TestGetNodesForTarget_Workers(t *testing.T) {
+	setupTestConfig()
+
+	nodes, err := getNodesForTarget("workers")
+	require.NoError(t, err)
+	assert.Len(t, nodes, 2)
+
+	for _, node := range nodes {
+		assert.Equal(t, config.RoleWorker, node.Role)
+	}
+}
+
+func TestGetNodesForTarget_ControlPlanes(t *testing.T) {
+	setupTestConfig()
+
+	nodes, err := getNodesForTarget("controlplanes")
+	require.NoError(t, err)
+	assert.Len(t, nodes, 2)
+
+	for _, node := range nodes {
+		assert.Equal(t, config.RoleControlPlane, node.Role)
+	}
+}
+
+func TestGetNodesForTarget_ByIP(t *testing.T) {
+	setupTestConfig()
+
+	nodes, err := getNodesForTarget("192.168.1.2")
+	require.NoError(t, err)
+	require.Len(t, nodes, 1)
+	assert.Equal(t, "192.168.1.2", nodes[0].IP)
+	assert.Equal(t, "profile-a", nodes[0].Profile)
+}
+
+func TestGetNodesForTarget_ByProfile(t *testing.T) {
+	setupTestConfig()
+
+	nodes, err := getNodesForTarget("profile-b")
+	require.NoError(t, err)
+	assert.Len(t, nodes, 2)
+
+	for _, node := range nodes {
+		assert.Equal(t, "profile-b", node.Profile)
+	}
+}
+
+func TestGetNodesForTarget_UnknownTarget(t *testing.T) {
+	setupTestConfig()
+
+	nodes, err := getNodesForTarget("unknown-target")
+	assert.Error(t, err)
+	assert.Nil(t, nodes)
+	assert.Contains(t, err.Error(), "unknown target")
+}
+
+func TestGetNodesForTarget_NonexistentIP(t *testing.T) {
+	setupTestConfig()
+
+	// IP with 3 dots but not in config - treated as profile name search
+	nodes, err := getNodesForTarget("192.168.1.99")
+	assert.Error(t, err)
+	assert.Nil(t, nodes)
+}
+
+// ============================================================================
+// extensionsDiffer() Tests
+// ============================================================================
+
+func TestExtensionsDiffer_MatchingExtensions(t *testing.T) {
+	running := []talos.ExtensionInfo{
+		{Name: "i915", Version: "1.0.0"},
+		{Name: "iscsi-tools", Version: "1.0.0"},
+	}
+	expected := []string{"siderolabs/i915", "siderolabs/iscsi-tools"}
+
+	differs, diff := extensionsDiffer(running, expected)
+	assert.False(t, differs, "should not differ when extensions match")
+	assert.Empty(t, diff)
+}
+
+func TestExtensionsDiffer_MissingExtension(t *testing.T) {
+	running := []talos.ExtensionInfo{
+		{Name: "i915", Version: "1.0.0"},
+	}
+	expected := []string{"siderolabs/i915", "siderolabs/iscsi-tools"}
+
+	differs, diff := extensionsDiffer(running, expected)
+	assert.True(t, differs, "should differ when extension is missing")
+	assert.Contains(t, diff, "missing")
+	assert.Contains(t, diff, "iscsi-tools")
+}
+
+func TestExtensionsDiffer_ExtraExtension(t *testing.T) {
+	running := []talos.ExtensionInfo{
+		{Name: "i915", Version: "1.0.0"},
+		{Name: "iscsi-tools", Version: "1.0.0"},
+		{Name: "gasket-driver", Version: "1.0.0"},
+	}
+	expected := []string{"siderolabs/i915", "siderolabs/iscsi-tools"}
+
+	differs, diff := extensionsDiffer(running, expected)
+	assert.True(t, differs, "should differ when extra extension is present")
+	assert.Contains(t, diff, "extra")
+	assert.Contains(t, diff, "gasket-driver")
+}
+
+func TestExtensionsDiffer_BothMissingAndExtra(t *testing.T) {
+	running := []talos.ExtensionInfo{
+		{Name: "i915", Version: "1.0.0"},
+		{Name: "gasket-driver", Version: "1.0.0"},
+	}
+	expected := []string{"siderolabs/i915", "siderolabs/iscsi-tools"}
+
+	differs, diff := extensionsDiffer(running, expected)
+	assert.True(t, differs)
+	assert.Contains(t, diff, "missing")
+	assert.Contains(t, diff, "iscsi-tools")
+	assert.Contains(t, diff, "extra")
+	assert.Contains(t, diff, "gasket-driver")
+}
+
+func TestExtensionsDiffer_EmptyLists(t *testing.T) {
+	running := []talos.ExtensionInfo{}
+	expected := []string{}
+
+	differs, _ := extensionsDiffer(running, expected)
+	assert.False(t, differs, "empty lists should not differ")
+}
+
+func TestExtensionsDiffer_NoVendorPrefix(t *testing.T) {
+	running := []talos.ExtensionInfo{
+		{Name: "i915", Version: "1.0.0"},
+	}
+	// Extension without vendor prefix should still match
+	expected := []string{"i915"}
+
+	differs, _ := extensionsDiffer(running, expected)
+	assert.False(t, differs, "should handle extensions without vendor prefix")
+}
+
+func TestExtensionsDiffer_IgnoresInternalExtensions(t *testing.T) {
+	running := []talos.ExtensionInfo{
+		{Name: "i915", Version: "1.0.0"},
+		{Name: "schematic", Version: "abc123"},     // Internal - should be ignored
+		{Name: "modules.dep", Version: "6.18.1"},   // Internal - should be ignored
+	}
+	expected := []string{"siderolabs/i915"}
+
+	differs, diff := extensionsDiffer(running, expected)
+	assert.False(t, differs, "internal extensions should be ignored")
+	assert.Empty(t, diff)
+}
+
+// ============================================================================
+// upgradeNode() Tests
+// ============================================================================
+
+func TestUpgradeNode_AlreadyAtVersion(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = false
+	preserve = true
+
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.9.0", nil // Same as target
+		},
+		GetExtensionsFunc: func(ctx context.Context, nodeIP string) ([]talos.ExtensionInfo, error) {
+			return []talos.ExtensionInfo{
+				{Name: "i915", Version: "1.0.0"},
+			}, nil
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleWorker}
+	req := UpgradeRequest{
+		Node:               node,
+		Image:              "factory.talos.dev/installer/abc:v1.9.0",
+		Version:            "1.9.0",
+		ExpectedExtensions: []string{"siderolabs/i915"},
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	require.NoError(t, err)
+	assert.True(t, skipped, "should skip node already at target version with matching extensions")
+}
+
+func TestUpgradeNode_SameVersionDifferentExtensions(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = true // Use dry run to simplify test
+	defer func() { dryRun = false }()
+	preserve = true
+
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.9.0", nil // Same as target version
+		},
+		GetExtensionsFunc: func(ctx context.Context, nodeIP string) ([]talos.ExtensionInfo, error) {
+			return []talos.ExtensionInfo{
+				{Name: "i915", Version: "1.0.0"},
+			}, nil
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleWorker}
+	// Expected extensions include a new one not currently running
+	req := UpgradeRequest{
+		Node:               node,
+		Image:              "factory.talos.dev/installer/abc:v1.9.0",
+		Version:            "1.9.0",
+		ExpectedExtensions: []string{"siderolabs/i915", "siderolabs/gasket-driver"},
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	require.NoError(t, err)
+	assert.False(t, skipped, "should not skip when extensions differ even if version matches")
+}
+
+func TestUpgradeNode_DryRun(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = true
+	preserve = true
+
+	upgradeWasCalled := false
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil // Old version
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, preserve bool) error {
+			upgradeWasCalled = true
+			return nil
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleWorker}
+	req := UpgradeRequest{
+		Node:    node,
+		Image:   "factory.talos.dev/installer/abc:v1.9.0",
+		Version: "1.9.0",
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	require.NoError(t, err)
+	assert.False(t, skipped)
+	assert.False(t, upgradeWasCalled, "upgrade should not be called in dry run mode")
+
+	// Reset for other tests
+	dryRun = false
+}
+
+func TestUpgradeNode_Success_Worker(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = false
+	preserve = true
+
+	upgradeCalledWith := ""
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			// First call returns old version, second call returns new version
+			if upgradeCalledWith != "" {
+				return "1.9.0", nil
+			}
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			upgradeCalledWith = image
+			assert.Equal(t, "192.168.1.2", nodeIP)
+			assert.True(t, pres)
+			return nil
+		},
+		WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, cb talos.ProgressCallback) error {
+			// Simulate progress
+			if cb != nil {
+				cb(talos.UpgradeProgress{Stage: "upgrading"})
+				cb(talos.UpgradeProgress{Done: true})
+			}
+			return nil
+		},
+		WaitForServicesFunc: func(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+			// Worker services
+			assert.Contains(t, services, "kubelet")
+			return nil
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.2", Profile: "profile-a", Role: config.RoleWorker}
+	req := UpgradeRequest{
+		Node:    node,
+		Image:   "factory.talos.dev/installer/abc:v1.9.0",
+		Version: "1.9.0",
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	require.NoError(t, err)
+	assert.False(t, skipped)
+	assert.Equal(t, "factory.talos.dev/installer/abc:v1.9.0", upgradeCalledWith)
+}
+
+func TestUpgradeNode_Success_ControlPlane(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = false
+	preserve = true
+
+	waitForStaticPodsCalled := false
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			return nil
+		},
+		WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, cb talos.ProgressCallback) error {
+			return nil
+		},
+		WaitForServicesFunc: func(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+			// Control plane services should include etcd
+			assert.Contains(t, services, "etcd")
+			return nil
+		},
+		WaitForStaticPodsFunc: func(ctx context.Context, nodeIP string, timeout time.Duration) error {
+			waitForStaticPodsCalled = true
+			return nil
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleControlPlane}
+	req := UpgradeRequest{
+		Node:    node,
+		Image:   "factory.talos.dev/installer/abc:v1.9.0",
+		Version: "1.9.0",
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	require.NoError(t, err)
+	assert.False(t, skipped)
+	assert.True(t, waitForStaticPodsCalled, "should wait for static pods on control plane")
+}
+
+func TestUpgradeNode_GetVersionError(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = false
+	preserve = true
+
+	upgradeWasCalled := false
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "", fmt.Errorf("connection refused")
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			upgradeWasCalled = true
+			return nil
+		},
+		WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, cb talos.ProgressCallback) error {
+			return nil
+		},
+		WaitForServicesFunc: func(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+			return nil
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleWorker}
+	req := UpgradeRequest{
+		Node:    node,
+		Image:   "factory.talos.dev/installer/abc:v1.9.0",
+		Version: "1.9.0",
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	require.NoError(t, err)
+	assert.False(t, skipped)
+	assert.True(t, upgradeWasCalled, "should proceed with upgrade even if version check fails")
+}
+
+func TestUpgradeNode_UpgradeCommandFailure(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = false
+	preserve = true
+
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			return fmt.Errorf("upgrade rejected: disk full")
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleWorker}
+	req := UpgradeRequest{
+		Node:    node,
+		Image:   "factory.talos.dev/installer/abc:v1.9.0",
+		Version: "1.9.0",
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	require.Error(t, err)
+	assert.False(t, skipped)
+	assert.Contains(t, err.Error(), "upgrade command failed")
+}
+
+func TestUpgradeNode_WatchUpgradeFailure(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = false
+	preserve = true
+
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			return nil
+		},
+		WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, cb talos.ProgressCallback) error {
+			return fmt.Errorf("upgrade failed: kernel panic")
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleWorker}
+	req := UpgradeRequest{
+		Node:    node,
+		Image:   "factory.talos.dev/installer/abc:v1.9.0",
+		Version: "1.9.0",
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	require.Error(t, err)
+	assert.False(t, skipped)
+	assert.Contains(t, err.Error(), "upgrade failed")
+}
+
+func TestUpgradeNode_ServiceWaitTimeout(t *testing.T) {
+	setupTestConfig()
+	cfg.Settings.DefaultTimeoutSeconds = 60
+	dryRun = false
+	preserve = true
+
+	mock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			return nil
+		},
+		WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, cb talos.ProgressCallback) error {
+			return nil
+		},
+		WaitForServicesFunc: func(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+			return fmt.Errorf("timeout waiting for services")
+		},
+	}
+
+	node := config.Node{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleWorker}
+	req := UpgradeRequest{
+		Node:    node,
+		Image:   "factory.talos.dev/installer/abc:v1.9.0",
+		Version: "1.9.0",
+	}
+	skipped, err := upgradeNode(context.Background(), mock, req)
+
+	// Service wait timeout should log warning but not fail the upgrade
+	require.NoError(t, err)
+	assert.False(t, skipped)
+}
+
+// ============================================================================
+// confirm() Tests
+// ============================================================================
+
+func TestConfirm_Yes(t *testing.T) {
+	// Save and restore original reader
+	origReader := confirmReader
+	defer func() { confirmReader = origReader }()
+
+	confirmReader = strings.NewReader("y\n")
+	assert.True(t, confirm("Proceed?"))
+}
+
+func TestConfirm_YesFullWord(t *testing.T) {
+	origReader := confirmReader
+	defer func() { confirmReader = origReader }()
+
+	confirmReader = strings.NewReader("yes\n")
+	assert.True(t, confirm("Proceed?"))
+}
+
+func TestConfirm_YesUppercase(t *testing.T) {
+	origReader := confirmReader
+	defer func() { confirmReader = origReader }()
+
+	confirmReader = strings.NewReader("Y\n")
+	assert.True(t, confirm("Proceed?"))
+}
+
+func TestConfirm_No(t *testing.T) {
+	origReader := confirmReader
+	defer func() { confirmReader = origReader }()
+
+	confirmReader = strings.NewReader("n\n")
+	assert.False(t, confirm("Proceed?"))
+}
+
+func TestConfirm_Empty(t *testing.T) {
+	origReader := confirmReader
+	defer func() { confirmReader = origReader }()
+
+	confirmReader = strings.NewReader("\n")
+	assert.False(t, confirm("Proceed?"))
+}
+
+func TestConfirm_Invalid(t *testing.T) {
+	origReader := confirmReader
+	defer func() { confirmReader = origReader }()
+
+	confirmReader = strings.NewReader("maybe\n")
+	assert.False(t, confirm("Proceed?"))
+}
+
+// ============================================================================
+// runURLs() Tests
+// ============================================================================
+
+func TestRunURLs_SingleProfile(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {
+				Arch:       "amd64",
+				Platform:   "metal",
+				Extensions: []string{"siderolabs/i915"},
+			},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+
+	err := runURLs("1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunURLs_MultipleProfiles(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"zebra-profile": {Arch: "amd64", Platform: "metal"},
+			"alpha-profile": {Arch: "arm64", Platform: "metal"},
+			"beta-profile":  {Arch: "amd64", Platform: "metal", Secureboot: true},
+		},
+		Nodes: []config.Node{},
+	}
+
+	err := runURLs("1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunURLs_ProfileWithOverlay(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"rpi-profile": {
+				Arch:     "arm64",
+				Platform: "metal",
+				Overlay: &config.Overlay{
+					Name:  "rpi_generic",
+					Image: "siderolabs/sbc-raspberrypi",
+				},
+				Extensions: []string{"siderolabs/iscsi-tools"},
+			},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.10", Profile: "rpi-profile", Role: config.RoleWorker},
+		},
+	}
+
+	err := runURLs("1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunURLs_ProfileWithKernelArgs(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{
+			"custom-profile": {
+				Arch:       "amd64",
+				Platform:   "metal",
+				KernelArgs: []string{"amd_iommu=off", "nomodeset"},
+				Extensions: []string{"siderolabs/i915"},
+			},
+		},
+		Nodes: []config.Node{},
+	}
+
+	err := runURLs("1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunURLs_EmptyProfiles(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL: "https://factory.talos.dev",
+		},
+		Profiles: map[string]config.Profile{},
+		Nodes:    []config.Node{},
+	}
+
+	err := runURLs("1.9.0")
+	require.NoError(t, err)
+}
+
+// ============================================================================
+// runUpgradeWithClients() Tests
+// ============================================================================
+
+func TestRunUpgradeWithClients_Success(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = true // Use dry run to simplify test
+	defer func() { dryRun = false }()
+
+	talosMock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			return talos.NodeStatus{IP: nodeIP, Version: "1.9.0", Profile: profile, Role: role}
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return fmt.Sprintf("factory.talos.dev/installer/abc:v%s", version), nil
+		},
+	}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "all", "1.9.0")
+	require.NoError(t, err)
+}
+
+func TestRunUpgradeWithClients_NoNodesFound(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{}, // No nodes
+	}
+	dryRun = false
+
+	talosMock := &talos.MockClient{}
+	factoryMock := &factory.MockFactoryClient{}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "all", "1.9.0")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "no nodes found")
+}
+
+func TestRunUpgradeWithClients_UnknownTarget(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = false
+
+	talosMock := &talos.MockClient{}
+	factoryMock := &factory.MockFactoryClient{}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "unknown-target", "1.9.0")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unknown target")
+}
+
+func TestRunUpgradeWithClients_DryRun(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = true
+	defer func() { dryRun = false }()
+
+	upgradeWasCalled := false
+	talosMock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			upgradeWasCalled = true
+			return nil
+		},
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			return talos.NodeStatus{IP: nodeIP, Version: "1.9.0", Profile: profile, Role: role}
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return "factory.talos.dev/installer/abc:v1.9.0", nil
+		},
+	}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "all", "1.9.0")
+	require.NoError(t, err)
+	assert.False(t, upgradeWasCalled, "upgrade should not be called in dry run mode")
+}
+
+func TestRunUpgradeWithClients_UserCancels(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = false
+
+	// Mock user saying "no"
+	origReader := confirmReader
+	confirmReader = strings.NewReader("n\n")
+	defer func() { confirmReader = origReader }()
+
+	factoryCalled := false
+	talosMock := &talos.MockClient{}
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			factoryCalled = true
+			return "factory.talos.dev/installer/abc:v1.9.0", nil
+		},
+	}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "all", "1.9.0")
+	require.NoError(t, err) // Cancellation is not an error
+	assert.False(t, factoryCalled, "factory should not be called after user cancels")
+}
+
+func TestRunUpgradeWithClients_FactoryError(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = false
+
+	// Mock user confirming
+	origReader := confirmReader
+	confirmReader = strings.NewReader("y\n")
+	defer func() { confirmReader = origReader }()
+
+	talosMock := &talos.MockClient{}
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return "", fmt.Errorf("API error: rate limited")
+		},
+	}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "all", "1.9.0")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to get image")
+	assert.Contains(t, err.Error(), "test-profile")
+}
+
+func TestRunUpgradeWithClients_NodeFailure(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+			{IP: "192.168.1.2", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = false
+
+	// Mock user confirming
+	origReader := confirmReader
+	confirmReader = strings.NewReader("y\n")
+	defer func() { confirmReader = origReader }()
+
+	nodesUpgraded := make(map[string]bool)
+	talosMock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			if nodeIP == "192.168.1.1" {
+				return fmt.Errorf("disk full")
+			}
+			nodesUpgraded[nodeIP] = true
+			return nil
+		},
+		WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, cb talos.ProgressCallback) error {
+			return nil
+		},
+		WaitForServicesFunc: func(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+			return nil
+		},
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			return talos.NodeStatus{IP: nodeIP, Version: "1.9.0", Profile: profile, Role: role}
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return "factory.talos.dev/installer/abc:v1.9.0", nil
+		},
+	}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "all", "1.9.0")
+	require.NoError(t, err) // Overall should succeed even with one node failure
+	assert.True(t, nodesUpgraded["192.168.1.2"], "second node should still be upgraded")
+}
+
+func TestRunUpgradeWithClients_CPFailureAbort(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleControlPlane},
+			{IP: "192.168.1.2", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = false
+
+	// Mock user confirming first prompt, then aborting on CP failure
+	origReader := confirmReader
+	confirmReader = strings.NewReader("y\nn\n")
+	defer func() { confirmReader = origReader }()
+
+	secondNodeAttempted := false
+	talosMock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			if nodeIP == "192.168.1.1" {
+				return fmt.Errorf("etcd cluster unhealthy")
+			}
+			secondNodeAttempted = true
+			return nil
+		},
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			return talos.NodeStatus{IP: nodeIP, Version: "1.9.0", Profile: profile, Role: role}
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return "factory.talos.dev/installer/abc:v1.9.0", nil
+		},
+	}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "controlplanes", "1.9.0")
+	require.NoError(t, err)
+	assert.False(t, secondNodeAttempted, "should not attempt second node after user aborts")
+}
+
+func TestRunUpgradeWithClients_AlreadyAtVersion(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"test-profile": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "test-profile", Role: config.RoleWorker},
+		},
+	}
+	dryRun = false
+
+	// Mock user confirming
+	origReader := confirmReader
+	confirmReader = strings.NewReader("y\n")
+	defer func() { confirmReader = origReader }()
+
+	upgradeWasCalled := false
+	talosMock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.9.0", nil // Already at target version
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, pres bool) error {
+			upgradeWasCalled = true
+			return nil
+		},
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			return talos.NodeStatus{IP: nodeIP, Version: "1.9.0", Profile: profile, Role: role}
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			return "factory.talos.dev/installer/abc:v1.9.0", nil
+		},
+	}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "all", "1.9.0")
+	require.NoError(t, err)
+	assert.False(t, upgradeWasCalled, "should skip upgrade for node already at version")
+}
+
+func TestRunUpgradeWithClients_MultipleProfiles(t *testing.T) {
+	cfg = &config.Config{
+		Settings: config.Settings{
+			FactoryBaseURL:        "https://factory.talos.dev",
+			DefaultTimeoutSeconds: 60,
+		},
+		Profiles: map[string]config.Profile{
+			"profile-a": {Arch: "amd64", Platform: "metal"},
+			"profile-b": {Arch: "arm64", Platform: "metal"},
+		},
+		Nodes: []config.Node{
+			{IP: "192.168.1.1", Profile: "profile-a", Role: config.RoleWorker},
+			{IP: "192.168.1.2", Profile: "profile-b", Role: config.RoleWorker},
+		},
+	}
+	dryRun = true
+	defer func() { dryRun = false }()
+
+	profilesRequested := make(map[string]bool)
+	talosMock := &talos.MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return "1.8.0", nil
+		},
+		GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) talos.NodeStatus {
+			return talos.NodeStatus{IP: nodeIP, Version: "1.9.0", Profile: profile, Role: role}
+		},
+	}
+
+	factoryMock := &factory.MockFactoryClient{
+		GetInstallerImageFunc: func(profile config.Profile, version string) (string, error) {
+			if profile.Arch == "amd64" {
+				profilesRequested["profile-a"] = true
+			} else if profile.Arch == "arm64" {
+				profilesRequested["profile-b"] = true
+			}
+			return fmt.Sprintf("factory.talos.dev/installer/%s:v%s", profile.Arch, version), nil
+		},
+	}
+
+	err := runUpgradeWithClients(context.Background(), talosMock, factoryMock, "all", "1.9.0")
+	require.NoError(t, err)
+	assert.True(t, profilesRequested["profile-a"], "should request image for profile-a")
+	assert.True(t, profilesRequested["profile-b"], "should request image for profile-b")
+}

internal/cmd/urls.go

···
+package cmd
+
+import (
+	"fmt"
+	"sort"
+
+	"github.com/evanjarrett/homelab/internal/factory"
+	"github.com/evanjarrett/homelab/internal/output"
+	"github.com/spf13/cobra"
+)
+
+func urlsCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "urls [version]",
+		Short: "Generate factory URLs for each profile (for browser)",
+		Long: `Generate factory.talos.dev URLs that can be opened in a browser
+to download images or get installer commands for each profile.`,
+		Args: cobra.MaximumNArgs(1),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			return loadConfig()
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// Get version from args or flags
+			version := ""
+			if len(args) > 0 {
+				version = args[0]
+			}
+			if version == "" {
+				var err error
+				version, err = getVersion()
+				if err != nil {
+					return err
+				}
+			}
+
+			return runURLs(version)
+		},
+	}
+}
+
+func runURLs(version string) error {
+	output.Header("Factory URLs for Talos v%s", version)
+	fmt.Println()
+	fmt.Println("Open these URLs in a browser to download images or get installer commands.")
+	fmt.Println()
+
+	// Sort profile names for consistent output
+	var profileNames []string
+	for name := range cfg.Profiles {
+		profileNames = append(profileNames, name)
+	}
+	sort.Strings(profileNames)
+
+	for _, name := range profileNames {
+		profile := cfg.Profiles[name]
+
+		output.SubHeader("Profile: %s", name)
+
+		// Print profile info
+		fmt.Printf("  Arch: %s, Secureboot: %v\n", profile.Arch, profile.Secureboot)
+		if profile.Overlay != nil {
+			fmt.Printf("  Overlay: %s\n", profile.Overlay.Name)
+		}
+		if len(profile.KernelArgs) > 0 {
+			fmt.Printf("  Kernel Args: %v\n", profile.KernelArgs)
+		}
+		fmt.Printf("  Extensions: %v\n", profile.Extensions)
+		fmt.Println()
+
+		// Generate and print URL
+		url := factory.GenerateFactoryURL(profile, version, cfg.Settings.FactoryBaseURL)
+		fmt.Printf("  URL:\n%s\n", url)
+		fmt.Println()
+
+		// Print nodes using this profile
+		nodes := cfg.GetNodesByProfile(name)
+		if len(nodes) > 0 {
+			fmt.Println("  Nodes:")
+			for _, node := range nodes {
+				fmt.Printf("    - %s (%s)\n", node.IP, node.Role)
+			}
+			fmt.Println()
+		}
+	}
+
+	return nil
+}

internal/config/config.go

···
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"time"
+
+	"gopkg.in/yaml.v3"
+)
+
+// DefaultConfigPaths defines where to search for config files
+var DefaultConfigPaths = []string{
+	"configs/talos-profiles.yaml",
+	"talos-profiles.yaml",
+}
+
+// Load reads and parses the configuration file
+func Load(path string) (*Config, error) {
+	if path == "" {
+		path = findDefaultConfig()
+		if path == "" {
+			return nil, fmt.Errorf("no config file found, tried: %v", DefaultConfigPaths)
+		}
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read config file %s: %w", path, err)
+	}
+
+	var cfg Config
+	if err := yaml.Unmarshal(data, &cfg); err != nil {
+		return nil, fmt.Errorf("failed to parse config file %s: %w", path, err)
+	}
+
+	if err := cfg.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid config: %w", err)
+	}
+
+	return &cfg, nil
+}
+
+// findDefaultConfig searches for config in default locations
+func findDefaultConfig() string {
+	// First check relative to current directory
+	for _, p := range DefaultConfigPaths {
+		if _, err := os.Stat(p); err == nil {
+			return p
+		}
+	}
+
+	// Check relative to executable location
+	exe, err := os.Executable()
+	if err == nil {
+		exeDir := filepath.Dir(exe)
+		for _, p := range DefaultConfigPaths {
+			fullPath := filepath.Join(exeDir, p)
+			if _, err := os.Stat(fullPath); err == nil {
+				return fullPath
+			}
+		}
+	}
+
+	return ""
+}
+
+// Validate checks that the configuration is valid
+func (c *Config) Validate() error {
+	if len(c.Profiles) == 0 {
+		return fmt.Errorf("no profiles defined")
+	}
+
+	// Validate each profile
+	for name, profile := range c.Profiles {
+		if profile.Arch == "" {
+			return fmt.Errorf("profile %s: arch is required", name)
+		}
+		if profile.Platform == "" {
+			return fmt.Errorf("profile %s: platform is required", name)
+		}
+	}
+
+	// Either nodes or detection must be configured
+	hasNodes := len(c.Nodes) > 0
+	hasDetection := c.Detection != nil && len(c.Detection.Rules) > 0
+
+	if !hasNodes && !hasDetection {
+		return fmt.Errorf("either nodes or detection rules must be defined")
+	}
+
+	// Validate node references (if using legacy nodes config)
+	for _, node := range c.Nodes {
+		if node.IP == "" {
+			return fmt.Errorf("node with empty IP found")
+		}
+		if node.Profile == "" {
+			return fmt.Errorf("node %s: profile is required", node.IP)
+		}
+		if _, ok := c.Profiles[node.Profile]; !ok {
+			return fmt.Errorf("node %s: references unknown profile %s", node.IP, node.Profile)
+		}
+		if node.Role != RoleControlPlane && node.Role != RoleWorker {
+			return fmt.Errorf("node %s: role must be 'controlplane' or 'worker', got %s", node.IP, node.Role)
+		}
+	}
+
+	// Validate detection rules reference valid profiles
+	if c.Detection != nil {
+		for i, rule := range c.Detection.Rules {
+			if rule.Profile == "" {
+				return fmt.Errorf("detection rule %d: profile is required", i)
+			}
+			if _, ok := c.Profiles[rule.Profile]; !ok {
+				return fmt.Errorf("detection rule %d: references unknown profile %s", i, rule.Profile)
+			}
+			if rule.Match.SystemManufacturer == "" && rule.Match.ProcessorManufacturer == "" {
+				return fmt.Errorf("detection rule %d: at least one match criterion required", i)
+			}
+		}
+	}
+
+	return nil
+}
+
+// HasDetection returns true if detection rules are configured
+func (c *Config) HasDetection() bool {
+	return c.Detection != nil && len(c.Detection.Rules) > 0
+}
+
+// SetDefaults fills in default values for settings
+func (c *Config) SetDefaults() {
+	if c.Settings.FactoryBaseURL == "" {
+		c.Settings.FactoryBaseURL = "https://factory.talos.dev"
+	}
+	if c.Settings.DefaultTimeoutSeconds == 0 {
+		c.Settings.DefaultTimeoutSeconds = 600
+	}
+	if c.Settings.GithubReleasesURL == "" {
+		c.Settings.GithubReleasesURL = "https://api.github.com/repos/siderolabs/talos/releases/latest"
+	}
+}
+
+// githubRelease represents the GitHub API response for releases
+type githubRelease struct {
+	TagName string `json:"tag_name"`
+}
+
+// GetLatestTalosVersion fetches the latest Talos version from GitHub
+func GetLatestTalosVersion(githubURL string) (string, error) {
+	if githubURL == "" {
+		githubURL = "https://api.github.com/repos/siderolabs/talos/releases/latest"
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Get(githubURL)
+	if err != nil {
+		return "", fmt.Errorf("failed to fetch latest version: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("GitHub API returned status %d", resp.StatusCode)
+	}
+
+	var release githubRelease
+	if err := json.NewDecoder(resp.Body).Decode(&release); err != nil {
+		return "", fmt.Errorf("failed to decode GitHub response: %w", err)
+	}
+
+	// Strip leading 'v' if present
+	version := release.TagName
+	if len(version) > 0 && version[0] == 'v' {
+		version = version[1:]
+	}
+
+	if version == "" {
+		return "", fmt.Errorf("empty version returned from GitHub")
+	}
+
+	return version, nil
+}

internal/config/config_test.go

···
+package config
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// testdataDir returns the path to the testdata directory
+func testdataDir(t *testing.T) string {
+	t.Helper()
+	dir, err := os.Getwd()
+	require.NoError(t, err)
+	return filepath.Join(dir, "testdata")
+}
+
+func testdataPath(t *testing.T, filename string) string {
+	t.Helper()
+	return filepath.Join(testdataDir(t), filename)
+}
+
+// ============================================================================
+// Load() Tests
+// ============================================================================
+
+func TestLoad_ValidConfig(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "valid-config.yaml"))
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	assert.Len(t, cfg.Profiles, 2)
+	assert.Len(t, cfg.Nodes, 3)
+
+	// Verify profile content
+	intelProfile, ok := cfg.Profiles["amd64-intel"]
+	require.True(t, ok)
+	assert.Equal(t, "amd64", intelProfile.Arch)
+	assert.Equal(t, "metal", intelProfile.Platform)
+	assert.True(t, intelProfile.Secureboot)
+	assert.Contains(t, intelProfile.Extensions, "siderolabs/i915")
+
+	// Verify node content
+	assert.Equal(t, "192.168.1.101", cfg.Nodes[0].IP)
+	assert.Equal(t, "arm64-rpi", cfg.Nodes[0].Profile)
+	assert.Equal(t, "worker", cfg.Nodes[0].Role)
+
+	// Verify settings
+	assert.Equal(t, "https://factory.talos.dev", cfg.Settings.FactoryBaseURL)
+	assert.Equal(t, 600, cfg.Settings.DefaultTimeoutSeconds)
+}
+
+func TestLoad_MinimalConfig(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "minimal-config.yaml"))
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	assert.Len(t, cfg.Profiles, 1)
+	assert.Len(t, cfg.Nodes, 1)
+}
+
+func TestLoad_EmptyPathNoDefaultConfig(t *testing.T) {
+	// Change to temp dir with no config files to test findDefaultConfig() failure
+	origDir, err := os.Getwd()
+	require.NoError(t, err)
+
+	tmpDir := t.TempDir()
+	err = os.Chdir(tmpDir)
+	require.NoError(t, err)
+	defer os.Chdir(origDir)
+
+	cfg, err := Load("")
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "no config file found")
+}
+
+func TestLoad_NonexistentFile(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "nonexistent.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "failed to read config file")
+}
+
+func TestLoad_MalformedYAML(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "malformed.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "failed to parse config file")
+}
+
+func TestLoad_InvalidNoNodes(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "invalid-no-nodes.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "either nodes or detection rules must be defined")
+}
+
+func TestLoad_InvalidNoProfiles(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "invalid-no-profiles.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "no profiles defined")
+}
+
+func TestLoad_InvalidUnknownProfile(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "invalid-unknown-profile.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "references unknown profile")
+}
+
+func TestLoad_InvalidMissingArch(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "invalid-missing-arch.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "arch is required")
+}
+
+func TestLoad_InvalidBadRole(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "invalid-bad-role.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "role must be 'controlplane' or 'worker'")
+}
+
+// ============================================================================
+// Validate() Tests
+// ============================================================================
+
+func TestValidate_Success(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "test", Role: RoleControlPlane},
+		},
+	}
+	assert.NoError(t, cfg.Validate())
+}
+
+func TestValidate_EmptyProfiles(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{},
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "test", Role: RoleControlPlane},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "no profiles defined")
+}
+
+func TestValidate_EmptyNodes(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []Node{},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "either nodes or detection rules must be defined")
+}
+
+func TestValidate_ProfileMissingArch(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Platform: "metal"},
+		},
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "test", Role: RoleControlPlane},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "arch is required")
+}
+
+func TestValidate_ProfileMissingPlatform(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64"},
+		},
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "test", Role: RoleControlPlane},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "platform is required")
+}
+
+func TestValidate_NodeEmptyIP(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []Node{
+			{IP: "", Profile: "test", Role: RoleControlPlane},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "node with empty IP")
+}
+
+func TestValidate_NodeEmptyProfile(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "", Role: RoleControlPlane},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "profile is required")
+}
+
+func TestValidate_NodeUnknownProfile(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "unknown", Role: RoleControlPlane},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "references unknown profile")
+}
+
+func TestValidate_NodeInvalidRole(t *testing.T) {
+	tests := []struct {
+		name string
+		role string
+	}{
+		{"empty role", ""},
+		{"master role", "master"},
+		{"invalid role", "invalid"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := &Config{
+				Profiles: map[string]Profile{
+					"test": {Arch: "amd64", Platform: "metal"},
+				},
+				Nodes: []Node{
+					{IP: "192.168.1.1", Profile: "test", Role: tt.role},
+				},
+			}
+			err := cfg.Validate()
+			assert.Error(t, err)
+			assert.Contains(t, err.Error(), "role must be 'controlplane' or 'worker'")
+		})
+	}
+}
+
+// ============================================================================
+// SetDefaults() Tests
+// ============================================================================
+
+func TestSetDefaults_Empty(t *testing.T) {
+	cfg := &Config{}
+	cfg.SetDefaults()
+
+	assert.Equal(t, "https://factory.talos.dev", cfg.Settings.FactoryBaseURL)
+	assert.Equal(t, 600, cfg.Settings.DefaultTimeoutSeconds)
+	assert.Equal(t, "https://api.github.com/repos/siderolabs/talos/releases/latest", cfg.Settings.GithubReleasesURL)
+}
+
+func TestSetDefaults_PreservesExisting(t *testing.T) {
+	cfg := &Config{
+		Settings: Settings{
+			FactoryBaseURL:        "https://custom.factory.dev",
+			DefaultTimeoutSeconds: 1200,
+			GithubReleasesURL:     "https://custom.github.api/releases",
+		},
+	}
+	cfg.SetDefaults()
+
+	assert.Equal(t, "https://custom.factory.dev", cfg.Settings.FactoryBaseURL)
+	assert.Equal(t, 1200, cfg.Settings.DefaultTimeoutSeconds)
+	assert.Equal(t, "https://custom.github.api/releases", cfg.Settings.GithubReleasesURL)
+}
+
+func TestSetDefaults_PartialSettings(t *testing.T) {
+	cfg := &Config{
+		Settings: Settings{
+			FactoryBaseURL: "https://custom.factory.dev",
+			// DefaultTimeoutSeconds and GithubReleasesURL are zero/empty
+		},
+	}
+	cfg.SetDefaults()
+
+	assert.Equal(t, "https://custom.factory.dev", cfg.Settings.FactoryBaseURL)
+	assert.Equal(t, 600, cfg.Settings.DefaultTimeoutSeconds)
+	assert.Equal(t, "https://api.github.com/repos/siderolabs/talos/releases/latest", cfg.Settings.GithubReleasesURL)
+}
+
+// ============================================================================
+// GetNodesByRole() Tests
+// ============================================================================
+
+func TestGetNodesByRole(t *testing.T) {
+	cfg := &Config{
+		Nodes: []Node{
+			{IP: "192.168.1.1", Role: RoleControlPlane},
+			{IP: "192.168.1.2", Role: RoleWorker},
+			{IP: "192.168.1.3", Role: RoleWorker},
+			{IP: "192.168.1.4", Role: RoleControlPlane},
+		},
+	}
+
+	t.Run("control planes", func(t *testing.T) {
+		nodes := cfg.GetNodesByRole(RoleControlPlane)
+		assert.Len(t, nodes, 2)
+		assert.Equal(t, "192.168.1.1", nodes[0].IP)
+		assert.Equal(t, "192.168.1.4", nodes[1].IP)
+	})
+
+	t.Run("workers", func(t *testing.T) {
+		nodes := cfg.GetNodesByRole(RoleWorker)
+		assert.Len(t, nodes, 2)
+		assert.Equal(t, "192.168.1.2", nodes[0].IP)
+		assert.Equal(t, "192.168.1.3", nodes[1].IP)
+	})
+
+	t.Run("no matching role", func(t *testing.T) {
+		nodes := cfg.GetNodesByRole("unknown")
+		assert.Empty(t, nodes)
+	})
+}
+
+// ============================================================================
+// GetNodesByProfile() Tests
+// ============================================================================
+
+func TestGetNodesByProfile(t *testing.T) {
+	cfg := &Config{
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "profile-a"},
+			{IP: "192.168.1.2", Profile: "profile-b"},
+			{IP: "192.168.1.3", Profile: "profile-a"},
+			{IP: "192.168.1.4", Profile: "profile-c"},
+		},
+	}
+
+	t.Run("profile-a", func(t *testing.T) {
+		nodes := cfg.GetNodesByProfile("profile-a")
+		assert.Len(t, nodes, 2)
+		assert.Equal(t, "192.168.1.1", nodes[0].IP)
+		assert.Equal(t, "192.168.1.3", nodes[1].IP)
+	})
+
+	t.Run("profile-b", func(t *testing.T) {
+		nodes := cfg.GetNodesByProfile("profile-b")
+		assert.Len(t, nodes, 1)
+		assert.Equal(t, "192.168.1.2", nodes[0].IP)
+	})
+
+	t.Run("no matching profile", func(t *testing.T) {
+		nodes := cfg.GetNodesByProfile("unknown")
+		assert.Empty(t, nodes)
+	})
+}
+
+// ============================================================================
+// GetNodeByIP() Tests
+// ============================================================================
+
+func TestGetNodeByIP(t *testing.T) {
+	cfg := &Config{
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "test", Role: RoleControlPlane},
+			{IP: "192.168.1.2", Profile: "test", Role: RoleWorker},
+		},
+	}
+
+	t.Run("existing node", func(t *testing.T) {
+		node := cfg.GetNodeByIP("192.168.1.1")
+		require.NotNil(t, node)
+		assert.Equal(t, "192.168.1.1", node.IP)
+		assert.Equal(t, RoleControlPlane, node.Role)
+	})
+
+	t.Run("non-existing node", func(t *testing.T) {
+		node := cfg.GetNodeByIP("192.168.1.99")
+		assert.Nil(t, node)
+	})
+
+	t.Run("empty IP", func(t *testing.T) {
+		node := cfg.GetNodeByIP("")
+		assert.Nil(t, node)
+	})
+}
+
+// ============================================================================
+// GetProfileForNode() Tests
+// ============================================================================
+
+func TestGetProfileForNode(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"profile-a": {Arch: "amd64", Platform: "metal"},
+			"profile-b": {Arch: "arm64", Platform: "metal"},
+		},
+		Nodes: []Node{
+			{IP: "192.168.1.1", Profile: "profile-a"},
+			{IP: "192.168.1.2", Profile: "profile-b"},
+		},
+	}
+
+	t.Run("existing node with profile", func(t *testing.T) {
+		profile := cfg.GetProfileForNode("192.168.1.1")
+		require.NotNil(t, profile)
+		assert.Equal(t, "amd64", profile.Arch)
+	})
+
+	t.Run("non-existing node", func(t *testing.T) {
+		profile := cfg.GetProfileForNode("192.168.1.99")
+		assert.Nil(t, profile)
+	})
+
+	t.Run("node with missing profile definition", func(t *testing.T) {
+		cfg := &Config{
+			Profiles: map[string]Profile{
+				"profile-a": {Arch: "amd64", Platform: "metal"},
+			},
+			Nodes: []Node{
+				{IP: "192.168.1.1", Profile: "missing-profile"},
+			},
+		}
+		profile := cfg.GetProfileForNode("192.168.1.1")
+		assert.Nil(t, profile)
+	})
+}
+
+// ============================================================================
+// GetControlPlaneNodes() and GetWorkerNodes() Tests
+// ============================================================================
+
+func TestGetControlPlaneNodes(t *testing.T) {
+	cfg := &Config{
+		Nodes: []Node{
+			{IP: "192.168.1.1", Role: RoleControlPlane},
+			{IP: "192.168.1.2", Role: RoleWorker},
+			{IP: "192.168.1.3", Role: RoleControlPlane},
+		},
+	}
+
+	nodes := cfg.GetControlPlaneNodes()
+	assert.Len(t, nodes, 2)
+	assert.Equal(t, "192.168.1.1", nodes[0].IP)
+	assert.Equal(t, "192.168.1.3", nodes[1].IP)
+}
+
+func TestGetWorkerNodes(t *testing.T) {
+	cfg := &Config{
+		Nodes: []Node{
+			{IP: "192.168.1.1", Role: RoleControlPlane},
+			{IP: "192.168.1.2", Role: RoleWorker},
+			{IP: "192.168.1.3", Role: RoleWorker},
+		},
+	}
+
+	nodes := cfg.GetWorkerNodes()
+	assert.Len(t, nodes, 2)
+	assert.Equal(t, "192.168.1.2", nodes[0].IP)
+	assert.Equal(t, "192.168.1.3", nodes[1].IP)
+}
+
+// ============================================================================
+// GetAllNodesOrdered() Tests
+// ============================================================================
+
+func TestGetAllNodesOrdered(t *testing.T) {
+	cfg := &Config{
+		Nodes: []Node{
+			{IP: "192.168.1.1", Role: RoleControlPlane},
+			{IP: "192.168.1.2", Role: RoleWorker},
+			{IP: "192.168.1.3", Role: RoleControlPlane},
+			{IP: "192.168.1.4", Role: RoleWorker},
+		},
+	}
+
+	nodes := cfg.GetAllNodesOrdered()
+	require.Len(t, nodes, 4)
+
+	// Workers should come first
+	assert.Equal(t, "192.168.1.2", nodes[0].IP)
+	assert.Equal(t, RoleWorker, nodes[0].Role)
+	assert.Equal(t, "192.168.1.4", nodes[1].IP)
+	assert.Equal(t, RoleWorker, nodes[1].Role)
+
+	// Then control planes
+	assert.Equal(t, "192.168.1.1", nodes[2].IP)
+	assert.Equal(t, RoleControlPlane, nodes[2].Role)
+	assert.Equal(t, "192.168.1.3", nodes[3].IP)
+	assert.Equal(t, RoleControlPlane, nodes[3].Role)
+}
+
+func TestGetAllNodesOrdered_OnlyWorkers(t *testing.T) {
+	cfg := &Config{
+		Nodes: []Node{
+			{IP: "192.168.1.1", Role: RoleWorker},
+			{IP: "192.168.1.2", Role: RoleWorker},
+		},
+	}
+
+	nodes := cfg.GetAllNodesOrdered()
+	assert.Len(t, nodes, 2)
+}
+
+func TestGetAllNodesOrdered_OnlyControlPlanes(t *testing.T) {
+	cfg := &Config{
+		Nodes: []Node{
+			{IP: "192.168.1.1", Role: RoleControlPlane},
+			{IP: "192.168.1.2", Role: RoleControlPlane},
+		},
+	}
+
+	nodes := cfg.GetAllNodesOrdered()
+	assert.Len(t, nodes, 2)
+}
+
+// ============================================================================
+// GetLatestTalosVersion() Tests
+// ============================================================================
+
+func TestGetLatestTalosVersion_Success(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		response := map[string]string{"tag_name": "v1.7.0"}
+		json.NewEncoder(w).Encode(response)
+	}))
+	defer server.Close()
+
+	version, err := GetLatestTalosVersion(server.URL)
+	require.NoError(t, err)
+	assert.Equal(t, "1.7.0", version) // 'v' should be stripped
+}
+
+func TestGetLatestTalosVersion_WithoutVPrefix(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		response := map[string]string{"tag_name": "1.7.0"}
+		json.NewEncoder(w).Encode(response)
+	}))
+	defer server.Close()
+
+	version, err := GetLatestTalosVersion(server.URL)
+	require.NoError(t, err)
+	assert.Equal(t, "1.7.0", version)
+}
+
+func TestGetLatestTalosVersion_ServerError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	version, err := GetLatestTalosVersion(server.URL)
+	assert.Error(t, err)
+	assert.Empty(t, version)
+	assert.Contains(t, err.Error(), "returned status 500")
+}
+
+func TestGetLatestTalosVersion_NotFound(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	version, err := GetLatestTalosVersion(server.URL)
+	assert.Error(t, err)
+	assert.Empty(t, version)
+	assert.Contains(t, err.Error(), "returned status 404")
+}
+
+func TestGetLatestTalosVersion_InvalidJSON(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("not json"))
+	}))
+	defer server.Close()
+
+	version, err := GetLatestTalosVersion(server.URL)
+	assert.Error(t, err)
+	assert.Empty(t, version)
+	assert.Contains(t, err.Error(), "failed to decode")
+}
+
+func TestGetLatestTalosVersion_EmptyVersion(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		response := map[string]string{"tag_name": ""}
+		json.NewEncoder(w).Encode(response)
+	}))
+	defer server.Close()
+
+	version, err := GetLatestTalosVersion(server.URL)
+	assert.Error(t, err)
+	assert.Empty(t, version)
+	assert.Contains(t, err.Error(), "empty version")
+}
+
+func TestGetLatestTalosVersion_ConnectionError(t *testing.T) {
+	// Use an invalid URL that will fail to connect
+	version, err := GetLatestTalosVersion("http://localhost:59999")
+	assert.Error(t, err)
+	assert.Empty(t, version)
+	assert.Contains(t, err.Error(), "failed to fetch")
+}
+
+func TestGetLatestTalosVersion_DefaultURL(t *testing.T) {
+	// This just ensures we don't panic when empty URL is passed
+	// and the default is used. We expect an error since we're not mocking GitHub.
+	version, err := GetLatestTalosVersion("")
+	// We expect either an error (network issues) or success (if GitHub is reachable)
+	// The important thing is it doesn't panic
+	_ = version
+	_ = err
+}
+
+// ============================================================================
+// Detection Rules Tests
+// ============================================================================
+
+func TestLoad_ValidDetectionConfig(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "valid-detection-config.yaml"))
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	// Should have profiles but no nodes
+	assert.Len(t, cfg.Profiles, 3)
+	assert.Empty(t, cfg.Nodes)
+
+	// Should have detection rules
+	require.NotNil(t, cfg.Detection)
+	assert.Len(t, cfg.Detection.Rules, 3)
+
+	// Verify detection rule content
+	assert.Equal(t, "amd64-intel", cfg.Detection.Rules[0].Profile)
+	assert.Equal(t, "Intel", cfg.Detection.Rules[0].Match.ProcessorManufacturer)
+
+	assert.Equal(t, "arm64-rpi", cfg.Detection.Rules[2].Profile)
+	assert.Equal(t, "Raspberry Pi", cfg.Detection.Rules[2].Match.SystemManufacturer)
+}
+
+func TestLoad_InvalidDetectionNoMatch(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "invalid-detection-no-match.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "at least one match criterion required")
+}
+
+func TestLoad_InvalidDetectionUnknownProfile(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "invalid-detection-unknown-profile.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "references unknown profile")
+}
+
+func TestLoad_InvalidDetectionEmptyProfile(t *testing.T) {
+	cfg, err := Load(testdataPath(t, "invalid-detection-empty-profile.yaml"))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "profile is required")
+}
+
+func TestValidate_WithDetectionRules(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Detection: &Detection{
+			Rules: []DetectionRule{
+				{
+					Profile: "test",
+					Match:   DetectionMatch{SystemManufacturer: "Dell"},
+				},
+			},
+		},
+	}
+	assert.NoError(t, cfg.Validate())
+}
+
+func TestValidate_DetectionRuleEmptyProfile(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Detection: &Detection{
+			Rules: []DetectionRule{
+				{
+					Profile: "",
+					Match:   DetectionMatch{SystemManufacturer: "Dell"},
+				},
+			},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "profile is required")
+}
+
+func TestValidate_DetectionRuleUnknownProfile(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Detection: &Detection{
+			Rules: []DetectionRule{
+				{
+					Profile: "nonexistent",
+					Match:   DetectionMatch{SystemManufacturer: "Dell"},
+				},
+			},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "references unknown profile")
+}
+
+func TestValidate_DetectionRuleNoMatchCriteria(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"test": {Arch: "amd64", Platform: "metal"},
+		},
+		Detection: &Detection{
+			Rules: []DetectionRule{
+				{
+					Profile: "test",
+					Match:   DetectionMatch{},
+				},
+			},
+		},
+	}
+	err := cfg.Validate()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "at least one match criterion required")
+}
+
+// ============================================================================
+// HasDetection() Tests
+// ============================================================================
+
+func TestHasDetection(t *testing.T) {
+	t.Run("with detection rules", func(t *testing.T) {
+		cfg := &Config{
+			Detection: &Detection{
+				Rules: []DetectionRule{
+					{Profile: "test", Match: DetectionMatch{SystemManufacturer: "Dell"}},
+				},
+			},
+		}
+		assert.True(t, cfg.HasDetection())
+	})
+
+	t.Run("nil detection", func(t *testing.T) {
+		cfg := &Config{}
+		assert.False(t, cfg.HasDetection())
+	})
+
+	t.Run("empty rules", func(t *testing.T) {
+		cfg := &Config{
+			Detection: &Detection{
+				Rules: []DetectionRule{},
+			},
+		}
+		assert.False(t, cfg.HasDetection())
+	})
+}
+
+// ============================================================================
+// DetectProfile() Tests
+// ============================================================================
+
+func TestDetectProfile(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"intel-profile": {Arch: "amd64", Platform: "metal"},
+			"amd-profile":   {Arch: "amd64", Platform: "metal"},
+			"dell-profile":  {Arch: "amd64", Platform: "metal"},
+		},
+		Detection: &Detection{
+			Rules: []DetectionRule{
+				{
+					Profile: "intel-profile",
+					Match:   DetectionMatch{ProcessorManufacturer: "Intel"},
+				},
+				{
+					Profile: "amd-profile",
+					Match:   DetectionMatch{ProcessorManufacturer: "AMD"},
+				},
+				{
+					Profile: "dell-profile",
+					Match:   DetectionMatch{SystemManufacturer: "Dell"},
+				},
+			},
+		},
+	}
+
+	t.Run("match processor manufacturer", func(t *testing.T) {
+		hw := &HardwareInfo{ProcessorManufacturer: "Intel Corporation"}
+		name, profile := cfg.DetectProfile(hw)
+		assert.Equal(t, "intel-profile", name)
+		require.NotNil(t, profile)
+		assert.Equal(t, "amd64", profile.Arch)
+	})
+
+	t.Run("match system manufacturer", func(t *testing.T) {
+		hw := &HardwareInfo{SystemManufacturer: "Dell Inc."}
+		name, profile := cfg.DetectProfile(hw)
+		assert.Equal(t, "dell-profile", name)
+		require.NotNil(t, profile)
+	})
+
+	t.Run("case insensitive match", func(t *testing.T) {
+		hw := &HardwareInfo{ProcessorManufacturer: "INTEL"}
+		name, profile := cfg.DetectProfile(hw)
+		assert.Equal(t, "intel-profile", name)
+		require.NotNil(t, profile)
+	})
+
+	t.Run("no match", func(t *testing.T) {
+		hw := &HardwareInfo{
+			SystemManufacturer:    "HP",
+			ProcessorManufacturer: "ARM",
+		}
+		name, profile := cfg.DetectProfile(hw)
+		assert.Empty(t, name)
+		assert.Nil(t, profile)
+	})
+
+	t.Run("nil hardware info", func(t *testing.T) {
+		name, profile := cfg.DetectProfile(nil)
+		assert.Empty(t, name)
+		assert.Nil(t, profile)
+	})
+
+	t.Run("nil detection config", func(t *testing.T) {
+		cfgNoDetection := &Config{
+			Profiles: map[string]Profile{
+				"test": {Arch: "amd64", Platform: "metal"},
+			},
+		}
+		hw := &HardwareInfo{ProcessorManufacturer: "Intel"}
+		name, profile := cfgNoDetection.DetectProfile(hw)
+		assert.Empty(t, name)
+		assert.Nil(t, profile)
+	})
+
+	t.Run("first matching rule wins", func(t *testing.T) {
+		cfgMultiple := &Config{
+			Profiles: map[string]Profile{
+				"first":  {Arch: "amd64", Platform: "metal"},
+				"second": {Arch: "arm64", Platform: "metal"},
+			},
+			Detection: &Detection{
+				Rules: []DetectionRule{
+					{Profile: "first", Match: DetectionMatch{SystemManufacturer: "Dell"}},
+					{Profile: "second", Match: DetectionMatch{SystemManufacturer: "Dell"}},
+				},
+			},
+		}
+		hw := &HardwareInfo{SystemManufacturer: "Dell Inc."}
+		name, _ := cfgMultiple.DetectProfile(hw)
+		assert.Equal(t, "first", name)
+	})
+
+	t.Run("rule references missing profile", func(t *testing.T) {
+		cfgBadRule := &Config{
+			Profiles: map[string]Profile{
+				"exists": {Arch: "amd64", Platform: "metal"},
+			},
+			Detection: &Detection{
+				Rules: []DetectionRule{
+					{Profile: "missing", Match: DetectionMatch{SystemManufacturer: "Dell"}},
+				},
+			},
+		}
+		hw := &HardwareInfo{SystemManufacturer: "Dell Inc."}
+		name, profile := cfgBadRule.DetectProfile(hw)
+		assert.Empty(t, name)
+		assert.Nil(t, profile)
+	})
+}
+
+func TestDetectProfile_MultipleMatchCriteria(t *testing.T) {
+	cfg := &Config{
+		Profiles: map[string]Profile{
+			"dell-intel": {Arch: "amd64", Platform: "metal"},
+		},
+		Detection: &Detection{
+			Rules: []DetectionRule{
+				{
+					Profile: "dell-intel",
+					Match: DetectionMatch{
+						SystemManufacturer:    "Dell",
+						ProcessorManufacturer: "Intel",
+					},
+				},
+			},
+		},
+	}
+
+	t.Run("both criteria match", func(t *testing.T) {
+		hw := &HardwareInfo{
+			SystemManufacturer:    "Dell Inc.",
+			ProcessorManufacturer: "Intel Corporation",
+		}
+		name, profile := cfg.DetectProfile(hw)
+		assert.Equal(t, "dell-intel", name)
+		require.NotNil(t, profile)
+	})
+
+	t.Run("only system matches", func(t *testing.T) {
+		hw := &HardwareInfo{
+			SystemManufacturer:    "Dell Inc.",
+			ProcessorManufacturer: "AMD",
+		}
+		name, profile := cfg.DetectProfile(hw)
+		assert.Empty(t, name)
+		assert.Nil(t, profile)
+	})
+
+	t.Run("only processor matches", func(t *testing.T) {
+		hw := &HardwareInfo{
+			SystemManufacturer:    "HP",
+			ProcessorManufacturer: "Intel Corporation",
+		}
+		name, profile := cfg.DetectProfile(hw)
+		assert.Empty(t, name)
+		assert.Nil(t, profile)
+	})
+}

internal/config/testdata/invalid-bad-role.yaml

···
+profiles:
+  basic:
+    arch: amd64
+    platform: metal
+    secureboot: false
+    extensions: []
+
+nodes:
+  - ip: 192.168.1.1
+    profile: basic
+    role: master

internal/config/testdata/invalid-detection-empty-profile.yaml

···
+profiles:
+  test:
+    arch: amd64
+    platform: metal
+
+detection:
+  rules:
+    - profile: ""
+      match:
+        system_manufacturer: Test

internal/config/testdata/invalid-detection-no-match.yaml

···
+profiles:
+  test:
+    arch: amd64
+    platform: metal
+
+detection:
+  rules:
+    - profile: test
+      match: {}

internal/config/testdata/invalid-detection-unknown-profile.yaml

···
+profiles:
+  test:
+    arch: amd64
+    platform: metal
+
+detection:
+  rules:
+    - profile: nonexistent
+      match:
+        system_manufacturer: Test

internal/config/testdata/invalid-missing-arch.yaml

···
+profiles:
+  basic:
+    platform: metal
+    secureboot: false
+    extensions: []
+
+nodes:
+  - ip: 192.168.1.1
+    profile: basic
+    role: controlplane

internal/config/testdata/invalid-no-nodes.yaml

···
+profiles:
+  basic:
+    arch: amd64
+    platform: metal
+    secureboot: false
+    extensions: []
+
+nodes: []

internal/config/testdata/invalid-no-profiles.yaml

···
+profiles: {}
+
+nodes:
+  - ip: 192.168.1.1
+    profile: basic
+    role: controlplane

internal/config/testdata/invalid-unknown-profile.yaml

···
+profiles:
+  basic:
+    arch: amd64
+    platform: metal
+    secureboot: false
+    extensions: []
+
+nodes:
+  - ip: 192.168.1.1
+    profile: nonexistent
+    role: controlplane

internal/config/testdata/malformed.yaml

···
+profiles:
+  basic
+    arch: amd64
+  invalid yaml here

internal/config/testdata/minimal-config.yaml

···
+profiles:
+  basic:
+    arch: amd64
+    platform: metal
+    secureboot: false
+    extensions: []
+
+nodes:
+  - ip: 192.168.1.1
+    profile: basic
+    role: controlplane

internal/config/testdata/valid-config.yaml

···
+settings:
+  factory_base_url: "https://factory.talos.dev"
+  default_timeout_seconds: 600
+  default_preserve: true
+  github_releases_url: "https://api.github.com/repos/siderolabs/talos/releases/latest"
+
+profiles:
+  amd64-intel:
+    description: "Intel GPU nodes"
+    arch: amd64
+    platform: metal
+    secureboot: true
+    extensions:
+      - siderolabs/i915
+      - siderolabs/iscsi-tools
+
+  arm64-rpi:
+    description: "Raspberry Pi workers"
+    arch: arm64
+    platform: metal
+    secureboot: false
+    overlay:
+      name: rpi_generic
+      image: siderolabs/sbc-raspberrypi
+    extensions:
+      - siderolabs/iscsi-tools
+
+nodes:
+  - ip: 192.168.1.101
+    profile: arm64-rpi
+    role: worker
+  - ip: 192.168.1.102
+    profile: arm64-rpi
+    role: worker
+  - ip: 192.168.1.201
+    profile: amd64-intel
+    role: controlplane

internal/config/testdata/valid-detection-config.yaml

···
+settings:
+  factory_base_url: "https://factory.talos.dev"
+  default_timeout_seconds: 600
+
+profiles:
+  amd64-intel:
+    description: "Intel GPU nodes"
+    arch: amd64
+    platform: metal
+    secureboot: true
+    extensions:
+      - siderolabs/i915
+
+  amd64-amd:
+    description: "AMD nodes"
+    arch: amd64
+    platform: metal
+    secureboot: true
+    extensions:
+      - siderolabs/amdgpu
+
+  arm64-rpi:
+    description: "Raspberry Pi workers"
+    arch: arm64
+    platform: metal
+    secureboot: false
+    overlay:
+      name: rpi_generic
+      image: siderolabs/sbc-raspberrypi
+
+detection:
+  rules:
+    - profile: amd64-intel
+      match:
+        processor_manufacturer: Intel
+    - profile: amd64-amd
+      match:
+        processor_manufacturer: AMD
+    - profile: arm64-rpi
+      match:
+        system_manufacturer: Raspberry Pi

internal/config/types.go

···
+package config
+
+import "strings"
+
+// Config represents the complete configuration file
+type Config struct {
+	Settings  Settings           `yaml:"settings"`
+	Profiles  map[string]Profile `yaml:"profiles"`
+	Nodes     []Node             `yaml:"nodes,omitempty"`     // Deprecated: use detection rules instead
+	Detection *Detection         `yaml:"detection,omitempty"` // Auto-detection configuration
+}
+
+// Settings contains global configuration
+type Settings struct {
+	FactoryBaseURL        string `yaml:"factory_base_url"`
+	DefaultTimeoutSeconds int    `yaml:"default_timeout_seconds"`
+	DefaultPreserve       bool   `yaml:"default_preserve"`
+	GithubReleasesURL     string `yaml:"github_releases_url"`
+}
+
+// Profile defines a hardware profile for nodes
+type Profile struct {
+	Description string   `yaml:"description,omitempty"`
+	Arch        string   `yaml:"arch"`
+	Platform    string   `yaml:"platform"`
+	Secureboot  bool     `yaml:"secureboot"`
+	KernelArgs  []string `yaml:"kernel_args,omitempty"`
+	Extensions  []string `yaml:"extensions"`
+	Overlay     *Overlay `yaml:"overlay,omitempty"`
+}
+
+// Overlay defines SBC overlay configuration
+type Overlay struct {
+	Name  string `yaml:"name"`
+	Image string `yaml:"image"`
+}
+
+// Node represents a single cluster node
+type Node struct {
+	IP      string `yaml:"ip"`
+	Profile string `yaml:"profile"`
+	Role    string `yaml:"role"` // controlplane, worker
+}
+
+// Detection configures automatic profile detection
+type Detection struct {
+	Rules []DetectionRule `yaml:"rules"`
+}
+
+// DetectionRule maps hardware characteristics to a profile
+type DetectionRule struct {
+	Profile string         `yaml:"profile"`
+	Match   DetectionMatch `yaml:"match"`
+}
+
+// DetectionMatch defines the hardware characteristics to match
+type DetectionMatch struct {
+	SystemManufacturer    string `yaml:"system_manufacturer,omitempty"`
+	ProcessorManufacturer string `yaml:"processor_manufacturer,omitempty"`
+}
+
+// HardwareInfo represents detected hardware information
+type HardwareInfo struct {
+	SystemManufacturer    string
+	SystemProductName     string
+	ProcessorManufacturer string
+	ProcessorProductName  string
+}
+
+// DetectProfile finds the matching profile for given hardware info
+func (c *Config) DetectProfile(hw *HardwareInfo) (string, *Profile) {
+	if c.Detection == nil || hw == nil {
+		return "", nil
+	}
+
+	for _, rule := range c.Detection.Rules {
+		if matchesRule(hw, &rule.Match) {
+			if profile, ok := c.Profiles[rule.Profile]; ok {
+				return rule.Profile, &profile
+			}
+		}
+	}
+	return "", nil
+}
+
+// matchesRule checks if hardware info matches a detection rule
+func matchesRule(hw *HardwareInfo, match *DetectionMatch) bool {
+	// Check system manufacturer (case-insensitive contains match)
+	if match.SystemManufacturer != "" {
+		if !strings.Contains(strings.ToLower(hw.SystemManufacturer), strings.ToLower(match.SystemManufacturer)) {
+			return false
+		}
+	}
+
+	// Check processor manufacturer (case-insensitive contains match)
+	if match.ProcessorManufacturer != "" {
+		if !strings.Contains(strings.ToLower(hw.ProcessorManufacturer), strings.ToLower(match.ProcessorManufacturer)) {
+			return false
+		}
+	}
+
+	// At least one match criterion must be specified
+	if match.SystemManufacturer == "" && match.ProcessorManufacturer == "" {
+		return false
+	}
+
+	return true
+}
+
+// NodeRole constants
+const (
+	RoleControlPlane = "controlplane"
+	RoleWorker       = "worker"
+)
+
+// GetNodesByRole returns nodes filtered by role
+func (c *Config) GetNodesByRole(role string) []Node {
+	var nodes []Node
+	for _, n := range c.Nodes {
+		if n.Role == role {
+			nodes = append(nodes, n)
+		}
+	}
+	return nodes
+}
+
+// GetNodesByProfile returns nodes filtered by profile name
+func (c *Config) GetNodesByProfile(profile string) []Node {
+	var nodes []Node
+	for _, n := range c.Nodes {
+		if n.Profile == profile {
+			nodes = append(nodes, n)
+		}
+	}
+	return nodes
+}
+
+// GetNodeByIP returns a node by IP address
+func (c *Config) GetNodeByIP(ip string) *Node {
+	for _, n := range c.Nodes {
+		if n.IP == ip {
+			return &n
+		}
+	}
+	return nil
+}
+
+// GetProfileForNode returns the profile for a given node IP
+func (c *Config) GetProfileForNode(ip string) *Profile {
+	node := c.GetNodeByIP(ip)
+	if node == nil {
+		return nil
+	}
+	profile, ok := c.Profiles[node.Profile]
+	if !ok {
+		return nil
+	}
+	return &profile
+}
+
+// GetControlPlaneNodes returns all control plane nodes
+func (c *Config) GetControlPlaneNodes() []Node {
+	return c.GetNodesByRole(RoleControlPlane)
+}
+
+// GetWorkerNodes returns all worker nodes
+func (c *Config) GetWorkerNodes() []Node {
+	return c.GetNodesByRole(RoleWorker)
+}
+
+// GetAllNodesOrdered returns nodes in upgrade order (workers first, then control planes)
+func (c *Config) GetAllNodesOrdered() []Node {
+	nodes := c.GetWorkerNodes()
+	nodes = append(nodes, c.GetControlPlaneNodes()...)
+	return nodes
+}

internal/factory/factory.go

···
+package factory
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"gopkg.in/yaml.v3"
+)
+
+// Schematic represents the YAML schema sent to factory.talos.dev
+type Schematic struct {
+	Overlay       *SchematicOverlay       `yaml:"overlay,omitempty"`
+	Customization *SchematicCustomization `yaml:"customization,omitempty"`
+}
+
+// SchematicOverlay for SBC boards
+type SchematicOverlay struct {
+	Name  string `yaml:"name"`
+	Image string `yaml:"image"`
+}
+
+// SchematicCustomization for extensions and kernel args
+type SchematicCustomization struct {
+	ExtraKernelArgs  []string                   `yaml:"extraKernelArgs,omitempty"`
+	SystemExtensions *SchematicSystemExtensions `yaml:"systemExtensions,omitempty"`
+}
+
+// SchematicSystemExtensions lists official extensions
+type SchematicSystemExtensions struct {
+	OfficialExtensions []string `yaml:"officialExtensions"`
+}
+
+// SchematicResponse from factory.talos.dev/schematics POST
+type SchematicResponse struct {
+	ID string `json:"id"`
+}
+
+// FactoryClientInterface defines the interface for factory API operations.
+// This enables mocking the factory client for testing.
+type FactoryClientInterface interface {
+	GetInstallerImage(profile config.Profile, version string) (string, error)
+	GetSchematicID(schematic *Schematic) (string, error)
+}
+
+// Client for interacting with the Talos Factory API
+type Client struct {
+	baseURL    string
+	httpClient *http.Client
+}
+
+// Ensure Client implements FactoryClientInterface
+var _ FactoryClientInterface = (*Client)(nil)
+
+// NewClient creates a new Factory API client
+func NewClient(baseURL string) *Client {
+	if baseURL == "" {
+		baseURL = "https://factory.talos.dev"
+	}
+	return &Client{
+		baseURL:    baseURL,
+		httpClient: &http.Client{Timeout: 30 * time.Second},
+	}
+}
+
+// BuildSchematic creates a Schematic from a Profile
+func BuildSchematic(profile config.Profile) *Schematic {
+	schematic := &Schematic{
+		Customization: &SchematicCustomization{},
+	}
+
+	// Add extensions
+	if len(profile.Extensions) > 0 {
+		schematic.Customization.SystemExtensions = &SchematicSystemExtensions{
+			OfficialExtensions: profile.Extensions,
+		}
+	}
+
+	// Add kernel args if present
+	if len(profile.KernelArgs) > 0 {
+		schematic.Customization.ExtraKernelArgs = profile.KernelArgs
+	}
+
+	// Add overlay if present (SBC boards)
+	if profile.Overlay != nil {
+		schematic.Overlay = &SchematicOverlay{
+			Name:  profile.Overlay.Name,
+			Image: profile.Overlay.Image,
+		}
+	}
+
+	return schematic
+}
+
+// GetSchematicID posts a schematic to the factory and returns the ID
+func (c *Client) GetSchematicID(schematic *Schematic) (string, error) {
+	yamlBytes, err := yaml.Marshal(schematic)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal schematic: %w", err)
+	}
+
+	resp, err := c.httpClient.Post(
+		c.baseURL+"/schematics",
+		"application/yaml",
+		bytes.NewReader(yamlBytes),
+	)
+	if err != nil {
+		return "", fmt.Errorf("failed to post schematic: %w", err)
+	}
+	defer resp.Body.Close()
+
+	// Accept both 200 OK and 201 Created
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		return "", fmt.Errorf("factory API returned status %d", resp.StatusCode)
+	}
+
+	var result SchematicResponse
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", fmt.Errorf("failed to decode response: %w", err)
+	}
+
+	if result.ID == "" {
+		return "", fmt.Errorf("empty schematic ID returned")
+	}
+
+	return result.ID, nil
+}
+
+// GetInstallerImage builds the full installer image URL for a profile
+func (c *Client) GetInstallerImage(profile config.Profile, version string) (string, error) {
+	schematic := BuildSchematic(profile)
+
+	schematicID, err := c.GetSchematicID(schematic)
+	if err != nil {
+		return "", err
+	}
+
+	imageBase := "factory.talos.dev/installer"
+	if profile.Secureboot {
+		imageBase = "factory.talos.dev/installer-secureboot"
+	}
+
+	return fmt.Sprintf("%s/%s:v%s", imageBase, schematicID, version), nil
+}
+
+// GenerateFactoryURL builds a browser-friendly URL for the Talos Factory
+func GenerateFactoryURL(profile config.Profile, version, baseURL string) string {
+	if baseURL == "" {
+		baseURL = "https://factory.talos.dev"
+	}
+
+	params := url.Values{}
+	params.Set("arch", profile.Arch)
+
+	if profile.Overlay != nil {
+		// SBC board handling
+		params.Set("board", profile.Overlay.Name)
+		params.Set("target", "sbc")
+	} else {
+		params.Set("target", "metal")
+		if profile.Secureboot {
+			params.Set("secureboot", "true")
+		}
+	}
+
+	params.Set("platform", profile.Platform)
+	params.Set("bootloader", "auto")
+	params.Set("cmdline-set", "true")
+	params.Set("version", version)
+
+	// Add kernel args
+	for _, arg := range profile.KernelArgs {
+		params.Add("cmdline", arg)
+	}
+
+	// Add extensions (reset first for SBC, then add each)
+	if profile.Overlay != nil {
+		params.Set("extensions", "-") // Reset default extensions for SBC
+	}
+	for _, ext := range profile.Extensions {
+		params.Add("extensions", ext)
+	}
+
+	return fmt.Sprintf("%s/?%s", baseURL, params.Encode())
+}
+
+// MockFactoryClient is a mock implementation of FactoryClientInterface for testing
+type MockFactoryClient struct {
+	GetInstallerImageFunc func(profile config.Profile, version string) (string, error)
+	GetSchematicIDFunc    func(schematic *Schematic) (string, error)
+}
+
+func (m *MockFactoryClient) GetInstallerImage(profile config.Profile, version string) (string, error) {
+	if m.GetInstallerImageFunc != nil {
+		return m.GetInstallerImageFunc(profile, version)
+	}
+	// Default: return a valid-looking image URL
+	return fmt.Sprintf("factory.talos.dev/installer/mock-schematic:v%s", version), nil
+}
+
+func (m *MockFactoryClient) GetSchematicID(schematic *Schematic) (string, error) {
+	if m.GetSchematicIDFunc != nil {
+		return m.GetSchematicIDFunc(schematic)
+	}
+	return "mock-schematic-id", nil
+}

internal/factory/factory_test.go

···
+package factory
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/evanjarrett/homelab/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+// ============================================================================
+// NewClient() Tests
+// ============================================================================
+
+func TestNewClient_DefaultURL(t *testing.T) {
+	client := NewClient("")
+	assert.Equal(t, "https://factory.talos.dev", client.baseURL)
+	assert.NotNil(t, client.httpClient)
+}
+
+func TestNewClient_CustomURL(t *testing.T) {
+	client := NewClient("https://custom.factory.dev")
+	assert.Equal(t, "https://custom.factory.dev", client.baseURL)
+}
+
+// ============================================================================
+// BuildSchematic() Tests
+// ============================================================================
+
+func TestBuildSchematic_MinimalProfile(t *testing.T) {
+	profile := config.Profile{
+		Arch:       "amd64",
+		Platform:   "metal",
+		Extensions: []string{},
+	}
+
+	schematic := BuildSchematic(profile)
+	require.NotNil(t, schematic)
+	assert.NotNil(t, schematic.Customization)
+	assert.Nil(t, schematic.Customization.SystemExtensions)
+	assert.Empty(t, schematic.Customization.ExtraKernelArgs)
+	assert.Nil(t, schematic.Overlay)
+}
+
+func TestBuildSchematic_WithExtensions(t *testing.T) {
+	profile := config.Profile{
+		Arch:     "amd64",
+		Platform: "metal",
+		Extensions: []string{
+			"siderolabs/i915",
+			"siderolabs/iscsi-tools",
+		},
+	}
+
+	schematic := BuildSchematic(profile)
+	require.NotNil(t, schematic)
+	require.NotNil(t, schematic.Customization)
+	require.NotNil(t, schematic.Customization.SystemExtensions)
+	assert.Len(t, schematic.Customization.SystemExtensions.OfficialExtensions, 2)
+	assert.Contains(t, schematic.Customization.SystemExtensions.OfficialExtensions, "siderolabs/i915")
+	assert.Contains(t, schematic.Customization.SystemExtensions.OfficialExtensions, "siderolabs/iscsi-tools")
+}
+
+func TestBuildSchematic_WithKernelArgs(t *testing.T) {
+	profile := config.Profile{
+		Arch:     "amd64",
+		Platform: "metal",
+		KernelArgs: []string{
+			"amd_iommu=off",
+			"nomodeset",
+		},
+	}
+
+	schematic := BuildSchematic(profile)
+	require.NotNil(t, schematic)
+	assert.Len(t, schematic.Customization.ExtraKernelArgs, 2)
+	assert.Contains(t, schematic.Customization.ExtraKernelArgs, "amd_iommu=off")
+	assert.Contains(t, schematic.Customization.ExtraKernelArgs, "nomodeset")
+}
+
+func TestBuildSchematic_WithOverlay(t *testing.T) {
+	profile := config.Profile{
+		Arch:     "arm64",
+		Platform: "metal",
+		Overlay: &config.Overlay{
+			Name:  "rpi_generic",
+			Image: "siderolabs/sbc-raspberrypi",
+		},
+	}
+
+	schematic := BuildSchematic(profile)
+	require.NotNil(t, schematic)
+	require.NotNil(t, schematic.Overlay)
+	assert.Equal(t, "rpi_generic", schematic.Overlay.Name)
+	assert.Equal(t, "siderolabs/sbc-raspberrypi", schematic.Overlay.Image)
+}
+
+func TestBuildSchematic_CompleteProfile(t *testing.T) {
+	profile := config.Profile{
+		Arch:       "arm64",
+		Platform:   "metal",
+		Secureboot: false,
+		KernelArgs: []string{"console=ttyS0"},
+		Extensions: []string{"siderolabs/iscsi-tools"},
+		Overlay: &config.Overlay{
+			Name:  "turingrk1",
+			Image: "siderolabs/sbc-rockchip",
+		},
+	}
+
+	schematic := BuildSchematic(profile)
+	require.NotNil(t, schematic)
+	require.NotNil(t, schematic.Customization)
+	require.NotNil(t, schematic.Customization.SystemExtensions)
+	require.NotNil(t, schematic.Overlay)
+
+	assert.Len(t, schematic.Customization.ExtraKernelArgs, 1)
+	assert.Len(t, schematic.Customization.SystemExtensions.OfficialExtensions, 1)
+	assert.Equal(t, "turingrk1", schematic.Overlay.Name)
+}
+
+func TestBuildSchematic_YAMLOutput(t *testing.T) {
+	profile := config.Profile{
+		Arch:     "amd64",
+		Platform: "metal",
+		Extensions: []string{
+			"siderolabs/i915",
+		},
+	}
+
+	schematic := BuildSchematic(profile)
+	yamlBytes, err := yaml.Marshal(schematic)
+	require.NoError(t, err)
+
+	// Verify YAML can be unmarshalled back
+	var parsed Schematic
+	err = yaml.Unmarshal(yamlBytes, &parsed)
+	require.NoError(t, err)
+	require.NotNil(t, parsed.Customization.SystemExtensions)
+	assert.Contains(t, parsed.Customization.SystemExtensions.OfficialExtensions, "siderolabs/i915")
+}
+
+// ============================================================================
+// GetSchematicID() Tests
+// ============================================================================
+
+func TestGetSchematicID_Success(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify request
+		assert.Equal(t, "POST", r.Method)
+		assert.Equal(t, "/schematics", r.URL.Path)
+		assert.Equal(t, "application/yaml", r.Header.Get("Content-Type"))
+
+		// Read and verify body is valid YAML
+		body, err := io.ReadAll(r.Body)
+		require.NoError(t, err)
+		var schematic Schematic
+		err = yaml.Unmarshal(body, &schematic)
+		assert.NoError(t, err)
+
+		// Return success
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(SchematicResponse{ID: "abc123def456"})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	schematic := &Schematic{
+		Customization: &SchematicCustomization{
+			SystemExtensions: &SchematicSystemExtensions{
+				OfficialExtensions: []string{"siderolabs/i915"},
+			},
+		},
+	}
+
+	id, err := client.GetSchematicID(schematic)
+	require.NoError(t, err)
+	assert.Equal(t, "abc123def456", id)
+}
+
+func TestGetSchematicID_Created201(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(SchematicResponse{ID: "newschematic123"})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	id, err := client.GetSchematicID(&Schematic{})
+	require.NoError(t, err)
+	assert.Equal(t, "newschematic123", id)
+}
+
+func TestGetSchematicID_ServerError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	id, err := client.GetSchematicID(&Schematic{})
+	assert.Error(t, err)
+	assert.Empty(t, id)
+	assert.Contains(t, err.Error(), "returned status 500")
+}
+
+func TestGetSchematicID_BadRequest(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	id, err := client.GetSchematicID(&Schematic{})
+	assert.Error(t, err)
+	assert.Empty(t, id)
+	assert.Contains(t, err.Error(), "returned status 400")
+}
+
+func TestGetSchematicID_InvalidJSON(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("not json"))
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	id, err := client.GetSchematicID(&Schematic{})
+	assert.Error(t, err)
+	assert.Empty(t, id)
+	assert.Contains(t, err.Error(), "failed to decode")
+}
+
+func TestGetSchematicID_EmptyID(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(SchematicResponse{ID: ""})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	id, err := client.GetSchematicID(&Schematic{})
+	assert.Error(t, err)
+	assert.Empty(t, id)
+	assert.Contains(t, err.Error(), "empty schematic ID")
+}
+
+func TestGetSchematicID_ConnectionError(t *testing.T) {
+	client := NewClient("http://localhost:59999")
+	id, err := client.GetSchematicID(&Schematic{})
+	assert.Error(t, err)
+	assert.Empty(t, id)
+	assert.Contains(t, err.Error(), "failed to post schematic")
+}
+
+// ============================================================================
+// GetInstallerImage() Tests
+// ============================================================================
+
+func TestGetInstallerImage_Standard(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(SchematicResponse{ID: "schematic123"})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	profile := config.Profile{
+		Arch:       "amd64",
+		Platform:   "metal",
+		Secureboot: false,
+		Extensions: []string{"siderolabs/i915"},
+	}
+
+	image, err := client.GetInstallerImage(profile, "1.7.0")
+	require.NoError(t, err)
+	assert.Equal(t, "factory.talos.dev/installer/schematic123:v1.7.0", image)
+}
+
+func TestGetInstallerImage_Secureboot(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(SchematicResponse{ID: "secureboot456"})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	profile := config.Profile{
+		Arch:       "amd64",
+		Platform:   "metal",
+		Secureboot: true,
+		Extensions: []string{"siderolabs/i915"},
+	}
+
+	image, err := client.GetInstallerImage(profile, "1.7.0")
+	require.NoError(t, err)
+	assert.Equal(t, "factory.talos.dev/installer-secureboot/secureboot456:v1.7.0", image)
+}
+
+func TestGetInstallerImage_APIError(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL)
+	profile := config.Profile{
+		Arch:     "amd64",
+		Platform: "metal",
+	}
+
+	image, err := client.GetInstallerImage(profile, "1.7.0")
+	assert.Error(t, err)
+	assert.Empty(t, image)
+}
+
+// ============================================================================
+// GenerateFactoryURL() Tests
+// ============================================================================
+
+func TestGenerateFactoryURL_BasicProfile(t *testing.T) {
+	profile := config.Profile{
+		Arch:       "amd64",
+		Platform:   "metal",
+		Secureboot: false,
+	}
+
+	urlStr := GenerateFactoryURL(profile, "1.7.0", "")
+
+	parsed, err := url.Parse(urlStr)
+	require.NoError(t, err)
+
+	assert.Equal(t, "https", parsed.Scheme)
+	assert.Equal(t, "factory.talos.dev", parsed.Host)
+	assert.Equal(t, "/", parsed.Path)
+
+	params := parsed.Query()
+	assert.Equal(t, "amd64", params.Get("arch"))
+	assert.Equal(t, "metal", params.Get("platform"))
+	assert.Equal(t, "metal", params.Get("target"))
+	assert.Equal(t, "1.7.0", params.Get("version"))
+	assert.Equal(t, "auto", params.Get("bootloader"))
+	assert.Equal(t, "true", params.Get("cmdline-set"))
+	assert.Empty(t, params.Get("secureboot"))
+}
+
+func TestGenerateFactoryURL_Secureboot(t *testing.T) {
+	profile := config.Profile{
+		Arch:       "amd64",
+		Platform:   "metal",
+		Secureboot: true,
+	}
+
+	urlStr := GenerateFactoryURL(profile, "1.7.0", "")
+
+	parsed, err := url.Parse(urlStr)
+	require.NoError(t, err)
+
+	params := parsed.Query()
+	assert.Equal(t, "true", params.Get("secureboot"))
+	assert.Equal(t, "metal", params.Get("target"))
+}
+
+func TestGenerateFactoryURL_WithExtensions(t *testing.T) {
+	profile := config.Profile{
+		Arch:     "amd64",
+		Platform: "metal",
+		Extensions: []string{
+			"siderolabs/i915",
+			"siderolabs/iscsi-tools",
+		},
+	}
+
+	urlStr := GenerateFactoryURL(profile, "1.7.0", "")
+
+	parsed, err := url.Parse(urlStr)
+	require.NoError(t, err)
+
+	params := parsed.Query()
+	extensions := params["extensions"]
+	assert.Len(t, extensions, 2)
+	assert.Contains(t, extensions, "siderolabs/i915")
+	assert.Contains(t, extensions, "siderolabs/iscsi-tools")
+}
+
+func TestGenerateFactoryURL_WithKernelArgs(t *testing.T) {
+	profile := config.Profile{
+		Arch:     "amd64",
+		Platform: "metal",
+		KernelArgs: []string{
+			"amd_iommu=off",
+			"nomodeset",
+		},
+	}
+
+	urlStr := GenerateFactoryURL(profile, "1.7.0", "")
+
+	parsed, err := url.Parse(urlStr)
+	require.NoError(t, err)
+
+	params := parsed.Query()
+	cmdline := params["cmdline"]
+	assert.Len(t, cmdline, 2)
+	assert.Contains(t, cmdline, "amd_iommu=off")
+	assert.Contains(t, cmdline, "nomodeset")
+}
+
+func TestGenerateFactoryURL_SBCWithOverlay(t *testing.T) {
+	profile := config.Profile{
+		Arch:     "arm64",
+		Platform: "metal",
+		Overlay: &config.Overlay{
+			Name:  "rpi_generic",
+			Image: "siderolabs/sbc-raspberrypi",
+		},
+		Extensions: []string{"siderolabs/iscsi-tools"},
+	}
+
+	urlStr := GenerateFactoryURL(profile, "1.7.0", "")
+
+	parsed, err := url.Parse(urlStr)
+	require.NoError(t, err)
+
+	params := parsed.Query()
+	assert.Equal(t, "arm64", params.Get("arch"))
+	assert.Equal(t, "sbc", params.Get("target"))
+	assert.Equal(t, "rpi_generic", params.Get("board"))
+	assert.Empty(t, params.Get("secureboot")) // SBCs don't use secureboot param
+
+	// SBCs should have "-" to reset defaults, then extensions
+	extensions := params["extensions"]
+	assert.Contains(t, extensions, "-")
+	assert.Contains(t, extensions, "siderolabs/iscsi-tools")
+}
+
+func TestGenerateFactoryURL_CustomBaseURL(t *testing.T) {
+	profile := config.Profile{
+		Arch:     "amd64",
+		Platform: "metal",
+	}
+
+	urlStr := GenerateFactoryURL(profile, "1.7.0", "https://custom.factory.dev")
+
+	parsed, err := url.Parse(urlStr)
+	require.NoError(t, err)
+
+	assert.Equal(t, "https", parsed.Scheme)
+	assert.Equal(t, "custom.factory.dev", parsed.Host)
+}
+
+func TestGenerateFactoryURL_CompleteProfile(t *testing.T) {
+	profile := config.Profile{
+		Arch:       "amd64",
+		Platform:   "metal",
+		Secureboot: true,
+		KernelArgs: []string{"console=ttyS0"},
+		Extensions: []string{
+			"siderolabs/i915",
+			"siderolabs/nut-client",
+		},
+	}
+
+	urlStr := GenerateFactoryURL(profile, "1.8.0", "")
+
+	parsed, err := url.Parse(urlStr)
+	require.NoError(t, err)
+
+	params := parsed.Query()
+	assert.Equal(t, "amd64", params.Get("arch"))
+	assert.Equal(t, "metal", params.Get("platform"))
+	assert.Equal(t, "metal", params.Get("target"))
+	assert.Equal(t, "true", params.Get("secureboot"))
+	assert.Equal(t, "1.8.0", params.Get("version"))
+
+	cmdline := params["cmdline"]
+	assert.Contains(t, cmdline, "console=ttyS0")
+
+	extensions := params["extensions"]
+	assert.Contains(t, extensions, "siderolabs/i915")
+	assert.Contains(t, extensions, "siderolabs/nut-client")
+}

internal/output/output.go

···
+package output
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"text/tabwriter"
+
+	"github.com/fatih/color"
+)
+
+var (
+	// Color functions
+	blue   = color.New(color.FgBlue).SprintFunc()
+	green  = color.New(color.FgGreen).SprintFunc()
+	yellow = color.New(color.FgYellow).SprintFunc()
+	red    = color.New(color.FgRed).SprintFunc()
+
+	// Output destination (can be changed for testing)
+	Out io.Writer = os.Stdout
+	Err io.Writer = os.Stderr
+)
+
+// LogInfo prints an info message with blue [INFO] prefix
+func LogInfo(format string, args ...interface{}) {
+	fmt.Fprintf(Out, "%s %s\n", blue("[INFO]"), fmt.Sprintf(format, args...))
+}
+
+// LogSuccess prints a success message with green [OK] prefix
+func LogSuccess(format string, args ...interface{}) {
+	fmt.Fprintf(Out, "%s %s\n", green("[OK]"), fmt.Sprintf(format, args...))
+}
+
+// LogWarn prints a warning message with yellow [WARN] prefix
+func LogWarn(format string, args ...interface{}) {
+	fmt.Fprintf(Out, "%s %s\n", yellow("[WARN]"), fmt.Sprintf(format, args...))
+}
+
+// LogError prints an error message with red [ERROR] prefix
+func LogError(format string, args ...interface{}) {
+	fmt.Fprintf(Err, "%s %s\n", red("[ERROR]"), fmt.Sprintf(format, args...))
+}
+
+// Header prints a header line
+func Header(format string, args ...interface{}) {
+	fmt.Fprintf(Out, "=== %s ===\n", fmt.Sprintf(format, args...))
+}
+
+// SubHeader prints a sub-header line
+func SubHeader(format string, args ...interface{}) {
+	fmt.Fprintf(Out, "--- %s ---\n", fmt.Sprintf(format, args...))
+}
+
+// Separator prints a separator line
+func Separator() {
+	fmt.Fprintln(Out, "============================================")
+}
+
+// Print prints a plain message
+func Print(format string, args ...interface{}) {
+	fmt.Fprintf(Out, format, args...)
+}
+
+// Println prints a plain message with newline
+func Println(format string, args ...interface{}) {
+	fmt.Fprintf(Out, format+"\n", args...)
+}
+
+// NewTabWriter creates a new tabwriter for formatted table output
+func NewTabWriter() *tabwriter.Writer {
+	return tabwriter.NewWriter(Out, 0, 0, 2, ' ', 0)
+}
+
+// StatusColor returns the appropriate color function for a status
+func StatusColor(status string) func(a ...interface{}) string {
+	switch status {
+	case "OK", "Ready", "true":
+		return green
+	case "UNREACHABLE", "NotReady", "false":
+		return red
+	default:
+		return yellow
+	}
+}
+
+// RoleColor returns a color function for node roles
+func RoleColor(role string) func(a ...interface{}) string {
+	switch role {
+	case "controlplane":
+		return color.New(color.FgMagenta).SprintFunc()
+	case "worker":
+		return color.New(color.FgCyan).SprintFunc()
+	default:
+		return color.New(color.FgWhite).SprintFunc()
+	}
+}
+
+// ProgressDot prints a progress dot (for waiting loops)
+func ProgressDot() {
+	fmt.Fprint(Out, ".")
+}
+
+// ProgressNewline ends a progress line
+func ProgressNewline() {
+	fmt.Fprintln(Out)
+}

internal/output/output_test.go

···
+package output
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// captureOutput captures stdout and stderr during a test
+func captureOutput(t *testing.T, fn func()) (stdout, stderr string) {
+	t.Helper()
+
+	oldOut := Out
+	oldErr := Err
+	defer func() {
+		Out = oldOut
+		Err = oldErr
+	}()
+
+	var outBuf, errBuf bytes.Buffer
+	Out = &outBuf
+	Err = &errBuf
+
+	fn()
+
+	return outBuf.String(), errBuf.String()
+}
+
+// ============================================================================
+// LogInfo() Tests
+// ============================================================================
+
+func TestLogInfo_SimpleMessage(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogInfo("test message")
+	})
+
+	assert.Contains(t, stdout, "[INFO]")
+	assert.Contains(t, stdout, "test message")
+	assert.True(t, strings.HasSuffix(stdout, "\n"))
+}
+
+func TestLogInfo_Formatted(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogInfo("node %s version %s", "192.168.1.1", "1.7.0")
+	})
+
+	assert.Contains(t, stdout, "[INFO]")
+	assert.Contains(t, stdout, "node 192.168.1.1 version 1.7.0")
+}
+
+// ============================================================================
+// LogSuccess() Tests
+// ============================================================================
+
+func TestLogSuccess_SimpleMessage(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogSuccess("operation complete")
+	})
+
+	assert.Contains(t, stdout, "[OK]")
+	assert.Contains(t, stdout, "operation complete")
+}
+
+func TestLogSuccess_Formatted(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogSuccess("upgraded %d nodes", 5)
+	})
+
+	assert.Contains(t, stdout, "upgraded 5 nodes")
+}
+
+// ============================================================================
+// LogWarn() Tests
+// ============================================================================
+
+func TestLogWarn_SimpleMessage(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogWarn("this is a warning")
+	})
+
+	assert.Contains(t, stdout, "[WARN]")
+	assert.Contains(t, stdout, "this is a warning")
+}
+
+func TestLogWarn_Formatted(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogWarn("node %s is unreachable", "192.168.1.99")
+	})
+
+	assert.Contains(t, stdout, "node 192.168.1.99 is unreachable")
+}
+
+// ============================================================================
+// LogError() Tests
+// ============================================================================
+
+func TestLogError_SimpleMessage(t *testing.T) {
+	_, stderr := captureOutput(t, func() {
+		LogError("something failed")
+	})
+
+	assert.Contains(t, stderr, "[ERROR]")
+	assert.Contains(t, stderr, "something failed")
+}
+
+func TestLogError_Formatted(t *testing.T) {
+	_, stderr := captureOutput(t, func() {
+		LogError("failed to connect to %s: %v", "192.168.1.1", "connection refused")
+	})
+
+	assert.Contains(t, stderr, "failed to connect to 192.168.1.1: connection refused")
+}
+
+// ============================================================================
+// Header() Tests
+// ============================================================================
+
+func TestHeader_SimpleMessage(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		Header("Talos Upgrade")
+	})
+
+	assert.Equal(t, "=== Talos Upgrade ===\n", stdout)
+}
+
+func TestHeader_Formatted(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		Header("Upgrade to v%s", "1.7.0")
+	})
+
+	assert.Equal(t, "=== Upgrade to v1.7.0 ===\n", stdout)
+}
+
+// ============================================================================
+// SubHeader() Tests
+// ============================================================================
+
+func TestSubHeader_SimpleMessage(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		SubHeader("Node Status")
+	})
+
+	assert.Equal(t, "--- Node Status ---\n", stdout)
+}
+
+func TestSubHeader_Formatted(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		SubHeader("Processing %d nodes", 10)
+	})
+
+	assert.Equal(t, "--- Processing 10 nodes ---\n", stdout)
+}
+
+// ============================================================================
+// Separator() Tests
+// ============================================================================
+
+func TestSeparator(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		Separator()
+	})
+
+	assert.Equal(t, "============================================\n", stdout)
+}
+
+// ============================================================================
+// Print() and Println() Tests
+// ============================================================================
+
+func TestPrint_NoNewline(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		Print("no newline")
+	})
+
+	assert.Equal(t, "no newline", stdout)
+	assert.False(t, strings.HasSuffix(stdout, "\n"))
+}
+
+func TestPrint_Formatted(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		Print("value: %d", 42)
+	})
+
+	assert.Equal(t, "value: 42", stdout)
+}
+
+func TestPrintln_WithNewline(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		Println("with newline")
+	})
+
+	assert.Equal(t, "with newline\n", stdout)
+}
+
+func TestPrintln_Formatted(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		Println("count: %d", 100)
+	})
+
+	assert.Equal(t, "count: 100\n", stdout)
+}
+
+// ============================================================================
+// NewTabWriter() Tests
+// ============================================================================
+
+func TestNewTabWriter(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		tw := NewTabWriter()
+		require.NotNil(t, tw)
+
+		tw.Write([]byte("column1\tcolumn2\tcolumn3\n"))
+		tw.Write([]byte("a\tb\tc\n"))
+		tw.Flush()
+	})
+
+	// Verify tabwriter produced aligned output
+	lines := strings.Split(strings.TrimSpace(stdout), "\n")
+	require.Len(t, lines, 2)
+
+	// Both lines should have consistent spacing (tabwriter adds padding)
+	assert.Contains(t, stdout, "column1")
+	assert.Contains(t, stdout, "column2")
+	assert.Contains(t, stdout, "column3")
+}
+
+// ============================================================================
+// StatusColor() Tests
+// ============================================================================
+
+func TestStatusColor_OK(t *testing.T) {
+	colorFn := StatusColor("OK")
+	assert.NotNil(t, colorFn)
+
+	// Verify it produces some output (color codes may vary)
+	result := colorFn("test")
+	assert.NotEmpty(t, result)
+}
+
+func TestStatusColor_Ready(t *testing.T) {
+	colorFn := StatusColor("Ready")
+	assert.NotNil(t, colorFn)
+}
+
+func TestStatusColor_True(t *testing.T) {
+	colorFn := StatusColor("true")
+	assert.NotNil(t, colorFn)
+}
+
+func TestStatusColor_Unreachable(t *testing.T) {
+	colorFn := StatusColor("UNREACHABLE")
+	assert.NotNil(t, colorFn)
+}
+
+func TestStatusColor_NotReady(t *testing.T) {
+	colorFn := StatusColor("NotReady")
+	assert.NotNil(t, colorFn)
+}
+
+func TestStatusColor_False(t *testing.T) {
+	colorFn := StatusColor("false")
+	assert.NotNil(t, colorFn)
+}
+
+func TestStatusColor_Unknown(t *testing.T) {
+	colorFn := StatusColor("unknown")
+	assert.NotNil(t, colorFn)
+}
+
+// ============================================================================
+// RoleColor() Tests
+// ============================================================================
+
+func TestRoleColor_ControlPlane(t *testing.T) {
+	colorFn := RoleColor("controlplane")
+	assert.NotNil(t, colorFn)
+
+	result := colorFn("controlplane")
+	assert.NotEmpty(t, result)
+}
+
+func TestRoleColor_Worker(t *testing.T) {
+	colorFn := RoleColor("worker")
+	assert.NotNil(t, colorFn)
+
+	result := colorFn("worker")
+	assert.NotEmpty(t, result)
+}
+
+func TestRoleColor_Unknown(t *testing.T) {
+	colorFn := RoleColor("unknown")
+	assert.NotNil(t, colorFn)
+
+	result := colorFn("unknown")
+	assert.NotEmpty(t, result)
+}
+
+// ============================================================================
+// ProgressDot() and ProgressNewline() Tests
+// ============================================================================
+
+func TestProgressDot(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		ProgressDot()
+		ProgressDot()
+		ProgressDot()
+	})
+
+	assert.Equal(t, "...", stdout)
+}
+
+func TestProgressNewline(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		ProgressDot()
+		ProgressDot()
+		ProgressNewline()
+	})
+
+	assert.Equal(t, "..\n", stdout)
+}
+
+// ============================================================================
+// Output Isolation Tests
+// ============================================================================
+
+func TestOutput_ErrorGoesToStderr(t *testing.T) {
+	stdout, stderr := captureOutput(t, func() {
+		LogInfo("info message")
+		LogSuccess("success message")
+		LogWarn("warning message")
+		LogError("error message")
+	})
+
+	// Info, Success, and Warn should go to stdout
+	assert.Contains(t, stdout, "[INFO]")
+	assert.Contains(t, stdout, "[OK]")
+	assert.Contains(t, stdout, "[WARN]")
+	assert.NotContains(t, stdout, "[ERROR]")
+
+	// Only Error should go to stderr
+	assert.Contains(t, stderr, "[ERROR]")
+	assert.NotContains(t, stderr, "[INFO]")
+}
+
+// ============================================================================
+// Edge Cases
+// ============================================================================
+
+func TestLogInfo_EmptyMessage(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogInfo("")
+	})
+
+	assert.Contains(t, stdout, "[INFO]")
+	// Message is empty but prefix should still be there
+}
+
+func TestLogInfo_SpecialCharacters(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogInfo("path: /var/log/file.txt, user: [e-mail]")
+	})
+
+	assert.Contains(t, stdout, "/var/log/file.txt")
+	assert.Contains(t, stdout, "[e-mail]")
+}
+
+func TestLogInfo_Unicode(t *testing.T) {
+	stdout, _ := captureOutput(t, func() {
+		LogInfo("status: %s", "✓ complete")
+	})
+
+	assert.Contains(t, stdout, "✓ complete")
+}

internal/talos/client.go

···
+package talos
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	talosclient "github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
+	"github.com/siderolabs/talos/pkg/machinery/resources/hardware"
+	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+// NodeStatus represents the status of a single node
+type NodeStatus struct {
+	IP          string
+	Profile     string
+	Role        string
+	Version     string
+	MachineType string
+	Secureboot  bool
+	Reachable   bool
+}
+
+// Client wraps the Talos SDK client
+type Client struct {
+	talos TalosMachineClient
+	k8s   kubernetes.Interface
+	clock Clock
+}
+
+// NewClient creates a new Talos client using default config
+func NewClient(ctx context.Context) (*Client, error) {
+	talosClient, err := talosclient.New(ctx, talosclient.WithDefaultConfig())
+	if err != nil {
+		return nil, fmt.Errorf("failed to create Talos client: %w", err)
+	}
+
+	// Wrap the SDK client
+	wrapper := newTalosClientWrapper(talosClient)
+
+	// Load kubeconfig for node ready checks
+	loadingRules := clientcmd.NewDefaultClientConfigLoadingRules()
+	configOverrides := &clientcmd.ConfigOverrides{}
+	kubeConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, configOverrides)
+
+	config, err := kubeConfig.ClientConfig()
+	if err != nil {
+		// K8s client is optional - we can still work without it
+		return &Client{talos: wrapper, k8s: nil, clock: newRealClock()}, nil
+	}
+
+	k8sClient, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		// K8s client is optional
+		return &Client{talos: wrapper, k8s: nil, clock: newRealClock()}, nil
+	}
+
+	return &Client{talos: wrapper, k8s: k8sClient, clock: newRealClock()}, nil
+}
+
+// Close closes the client connection
+func (c *Client) Close() error {
+	if c.talos != nil {
+		return c.talos.Close()
+	}
+	return nil
+}
+
+// GetVersion retrieves the Talos version for a node
+func (c *Client) GetVersion(ctx context.Context, nodeIP string) (string, error) {
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+	resp, err := c.talos.Version(nodeCtx)
+	if err != nil {
+		return "", fmt.Errorf("failed to get version: %w", err)
+	}
+
+	// Extract version from response
+	for _, msg := range resp.Messages {
+		if msg.Version != nil {
+			tag := msg.Version.Tag
+			// Strip leading 'v' if present
+			if len(tag) > 0 && tag[0] == 'v' {
+				tag = tag[1:]
+			}
+			return tag, nil
+		}
+	}
+	return "", fmt.Errorf("no version in response")
+}
+
+// GetMachineType retrieves the machine type (controlplane/worker) for a node
+// This is inferred from the Version response metadata since the COSI API
+// requires specific resource definitions that are internal to Talos
+func (c *Client) GetMachineType(ctx context.Context, nodeIP string) (string, error) {
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+
+	// The Version response includes platform info that can help identify node type
+	// For now, we rely on the config to provide the role
+	resp, err := c.talos.Version(nodeCtx)
+	if err != nil {
+		return "", fmt.Errorf("failed to get version: %w", err)
+	}
+
+	// Check if any message indicates this is a control plane
+	for _, msg := range resp.Messages {
+		if msg.Platform != nil {
+			// Platform info is available but doesn't directly indicate role
+			// The role is best obtained from config
+			break
+		}
+	}
+
+	// Return unknown - the caller should use the role from config
+	return "unknown", nil
+}
+
+// GetExtensions retrieves the list of installed extensions for a node
+func (c *Client) GetExtensions(ctx context.Context, nodeIP string) ([]ExtensionInfo, error) {
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+
+	// Query ExtensionStatus resources via COSI
+	list, err := c.talos.COSIList(nodeCtx, resource.NewMetadata(runtime.NamespaceName, runtime.ExtensionStatusType, "", resource.VersionUndefined))
+	if err != nil {
+		return nil, fmt.Errorf("failed to list extensions: %w", err)
+	}
+
+	var extensions []ExtensionInfo
+	for _, res := range list.Items {
+		status, ok := res.(*runtime.ExtensionStatus)
+		if !ok {
+			continue
+		}
+
+		spec := status.TypedSpec()
+		extensions = append(extensions, ExtensionInfo{
+			Name:    spec.Metadata.Name,
+			Version: spec.Metadata.Version,
+			Image:   spec.Image,
+		})
+	}
+
+	return extensions, nil
+}
+
+// IsReachable checks if a node is reachable via the Talos API
+func (c *Client) IsReachable(ctx context.Context, nodeIP string) bool {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	_, err := c.GetVersion(ctx, nodeIP)
+	return err == nil
+}
+
+// Upgrade performs an upgrade on a node
+func (c *Client) Upgrade(ctx context.Context, nodeIP, image string, preserve bool) error {
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+
+	_, err := c.talos.UpgradeWithOptions(
+		nodeCtx,
+		talosclient.WithUpgradeImage(image),
+		talosclient.WithUpgradePreserve(preserve),
+	)
+	if err != nil {
+		return fmt.Errorf("upgrade failed: %w", err)
+	}
+
+	return nil
+}
+
+// WaitForNode waits for a node to be ready after upgrade
+func (c *Client) WaitForNode(ctx context.Context, nodeIP string, timeout time.Duration) error {
+	clock := c.clock
+	if clock == nil {
+		clock = newRealClock()
+	}
+	deadline := clock.Now().Add(timeout)
+
+	for clock.Now().Before(deadline) {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		// Check Talos API reachability
+		if c.IsReachable(ctx, nodeIP) {
+			// Check Kubernetes node ready status if k8s client is available
+			if c.k8s == nil || c.isK8sNodeReady(ctx, nodeIP) {
+				return nil
+			}
+		}
+
+		clock.Sleep(5 * time.Second)
+	}
+
+	return fmt.Errorf("timeout waiting for node %s", nodeIP)
+}
+
+// isK8sNodeReady checks if the Kubernetes node is in Ready state
+func (c *Client) isK8sNodeReady(ctx context.Context, nodeIP string) bool {
+	if c.k8s == nil {
+		return true // Skip check if no k8s client
+	}
+
+	nodes, err := c.k8s.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return false
+	}
+
+	for _, node := range nodes.Items {
+		// Check if this node matches the IP
+		for _, addr := range node.Status.Addresses {
+			if addr.Address == nodeIP {
+				// Check Ready condition
+				for _, cond := range node.Status.Conditions {
+					if cond.Type == "Ready" && cond.Status == "True" {
+						return true
+					}
+				}
+			}
+		}
+	}
+
+	return false
+}
+
+// GetK8sNodeName returns the Kubernetes node name for an IP
+func (c *Client) GetK8sNodeName(ctx context.Context, nodeIP string) string {
+	if c.k8s == nil {
+		return ""
+	}
+
+	nodes, err := c.k8s.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return ""
+	}
+
+	for _, node := range nodes.Items {
+		for _, addr := range node.Status.Addresses {
+			if addr.Address == nodeIP {
+				return node.Name
+			}
+		}
+	}
+
+	return ""
+}
+
+// GetNodeStatus retrieves comprehensive status for a node
+func (c *Client) GetNodeStatus(ctx context.Context, nodeIP, profile, role string, secureboot bool) NodeStatus {
+	status := NodeStatus{
+		IP:          nodeIP,
+		Profile:     profile,
+		Role:        role,
+		Secureboot:  secureboot,
+		Reachable:   false,
+		Version:     "N/A",
+		MachineType: "unknown",
+	}
+
+	// Check reachability first
+	if !c.IsReachable(ctx, nodeIP) {
+		return status
+	}
+	status.Reachable = true
+
+	// Get version
+	if version, err := c.GetVersion(ctx, nodeIP); err == nil {
+		status.Version = version
+	}
+
+	// Get machine type
+	if machineType, err := c.GetMachineType(ctx, nodeIP); err == nil {
+		status.MachineType = strings.ToLower(machineType)
+	}
+
+	return status
+}
+
+// UpgradeProgress represents the current state of an upgrade
+type UpgradeProgress struct {
+	Stage  string // Machine stage: upgrading, rebooting, booting, running
+	Phase  string // Current phase name
+	Task   string // Current task name
+	Action string // START or STOP
+	Error  string // Error message if any
+	Done   bool   // True when upgrade is complete (node is running)
+}
+
+// ProgressCallback is called for each upgrade progress event
+type ProgressCallback func(UpgradeProgress)
+
+// WatchUpgrade streams upgrade events and calls the callback for each event.
+// It handles the node reboot by reconnecting and waiting for the node to reach RUNNING state.
+// Since the upgrade has already been initiated before this is called, any disconnect
+// means the node is rebooting and we should wait for it to come back.
+//
+// IMPORTANT: The upgrade sequence emits RUNNING twice:
+// 1. Before reboot (system still running while staging upgrade)
+// 2. After reboot (new system fully booted)
+// We must wait for the second RUNNING, which comes AFTER seeing UPGRADING/REBOOTING or connection loss.
+func (c *Client) WatchUpgrade(ctx context.Context, nodeIP string, timeout time.Duration, onProgress ProgressCallback) error {
+	clock := c.clock
+	if clock == nil {
+		clock = newRealClock()
+	}
+	deadline := clock.Now().Add(timeout)
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+
+	// Start watching events
+	eventCh := make(chan talosclient.EventResult, 100)
+
+	// Start event watcher in goroutine
+	watchCtx, watchCancel := context.WithCancel(nodeCtx)
+	defer watchCancel()
+
+	go func() {
+		// Watch from now (tail -1 means all new events)
+		// Note: Do NOT close eventCh - the SDK's internal goroutine may still send to it
+		// after this function returns. Let it be garbage collected.
+		c.talos.EventsWatchV2(watchCtx, eventCh, talosclient.WithTailEvents(-1))
+	}()
+
+	// Track if we've seen upgrade-related stages (upgrading, rebooting, or connection loss)
+	// We only consider RUNNING as "done" after seeing one of these
+	sawUpgradeStage := false
+
+	// Wait for first event with a startup timeout to detect silent connection failures
+	const startupTimeout = 15 * time.Second
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-clock.After(startupTimeout):
+		// No events received - event stream may have failed silently
+		// Fall back to polling for node to come back
+		if onProgress != nil {
+			onProgress(UpgradeProgress{Stage: "rebooting", Action: "no events received, polling"})
+		}
+		return c.waitForRunning(ctx, nodeIP, deadline.Sub(clock.Now()), onProgress)
+	case result := <-eventCh:
+		if result.Error != nil {
+			// Stream error on first event - node is likely rebooting
+			if onProgress != nil {
+				onProgress(UpgradeProgress{Stage: "rebooting", Action: "connection lost"})
+			}
+			return c.waitForRunning(ctx, nodeIP, deadline.Sub(clock.Now()), onProgress)
+		}
+		// Process first event
+		progress := c.parseEvent(result.Event)
+		if progress != nil {
+			if onProgress != nil {
+				onProgress(*progress)
+			}
+			// Track upgrade stages
+			if progress.Stage == "upgrading" || progress.Stage == "rebooting" {
+				sawUpgradeStage = true
+			}
+			if progress.Error != "" {
+				return fmt.Errorf("upgrade failed: %s", progress.Error)
+			}
+		}
+	}
+
+	// Process remaining events until done or timeout
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+
+		case <-clock.After(deadline.Sub(clock.Now())):
+			return fmt.Errorf("timeout waiting for upgrade to complete on %s", nodeIP)
+
+		case result := <-eventCh:
+			if result.Error != nil {
+				// Stream error - node is rebooting
+				sawUpgradeStage = true
+				if onProgress != nil {
+					onProgress(UpgradeProgress{Stage: "rebooting", Action: "connection lost"})
+				}
+				return c.waitForRunning(ctx, nodeIP, deadline.Sub(clock.Now()), onProgress)
+			}
+
+			// Process the event
+			progress := c.parseEvent(result.Event)
+			if progress != nil {
+				// Call the callback
+				if onProgress != nil {
+					onProgress(*progress)
+				}
+
+				// Track upgrade stages
+				if progress.Stage == "upgrading" || progress.Stage == "rebooting" {
+					sawUpgradeStage = true
+				}
+
+				// Only consider RUNNING as done if we've seen an upgrade stage
+				// This prevents exiting on the pre-reboot RUNNING event
+				if progress.Stage == "running" && sawUpgradeStage {
+					return nil
+				}
+
+				// Check for error in the event
+				if progress.Error != "" {
+					return fmt.Errorf("upgrade failed: %s", progress.Error)
+				}
+			}
+		}
+	}
+}
+
+// parseEvent converts a Talos event to UpgradeProgress
+func (c *Client) parseEvent(event talosclient.Event) *UpgradeProgress {
+	progress := &UpgradeProgress{}
+
+	switch e := event.Payload.(type) {
+	case *machine.SequenceEvent:
+		progress.Phase = e.GetSequence()
+		progress.Action = e.GetAction().String()
+		if e.GetError() != nil {
+			progress.Error = e.GetError().GetMessage()
+		}
+		return progress
+
+	case *machine.PhaseEvent:
+		progress.Phase = e.GetPhase()
+		progress.Action = e.GetAction().String()
+		return progress
+
+	case *machine.TaskEvent:
+		progress.Task = e.GetTask()
+		progress.Action = e.GetAction().String()
+		return progress
+
+	case *machine.MachineStatusEvent:
+		stage := e.GetStage()
+		progress.Stage = strings.ToLower(stage.String())
+		// Note: Don't set Done here - let caller decide based on context
+		// (e.g., WatchUpgrade tracks sawUpgradeStage before accepting RUNNING as done)
+		return progress
+
+	default:
+		// Unknown event type, ignore
+		return nil
+	}
+}
+
+// WaitForServices waits for critical Talos services to be healthy
+func (c *Client) WaitForServices(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+	clock := c.clock
+	if clock == nil {
+		clock = newRealClock()
+	}
+	deadline := clock.Now().Add(timeout)
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+
+	for clock.Now().Before(deadline) {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		allHealthy := true
+		for _, svc := range services {
+			resp, err := c.talos.ServiceInfo(nodeCtx, svc)
+			if err != nil {
+				allHealthy = false
+				break
+			}
+
+			// Check if service is running and healthy
+			// resp is []ServiceInfo with Service field containing the actual info
+			for _, svcInfo := range resp {
+				if svcInfo.Service != nil && svcInfo.Service.Id == svc {
+					if svcInfo.Service.State != "Running" || (svcInfo.Service.Health != nil && !svcInfo.Service.Health.Healthy) {
+						allHealthy = false
+					}
+				}
+			}
+		}
+
+		if allHealthy {
+			return nil
+		}
+
+		clock.Sleep(2 * time.Second)
+	}
+
+	return fmt.Errorf("timeout waiting for services to be healthy")
+}
+
+// GetControlPlaneServices returns the list of services to wait for on control plane nodes
+func GetControlPlaneServices() []string {
+	return []string{"etcd", "kubelet", "apid", "trustd"}
+}
+
+// GetWorkerServices returns the list of services to wait for on worker nodes
+func GetWorkerServices() []string {
+	return []string{"kubelet", "apid", "trustd"}
+}
+
+// WaitForStaticPods waits for K8s control plane static pods to be healthy
+func (c *Client) WaitForStaticPods(ctx context.Context, nodeIP string, timeout time.Duration) error {
+	clock := c.clock
+	if clock == nil {
+		clock = newRealClock()
+	}
+	deadline := clock.Now().Add(timeout)
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+
+	requiredPods := []string{"kube-apiserver", "kube-controller-manager", "kube-scheduler"}
+
+	for clock.Now().Before(deadline) {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		// List static pod statuses via COSI
+		list, err := c.talos.COSIList(nodeCtx, resource.NewMetadata(k8s.NamespaceName, k8s.StaticPodStatusType, "", resource.VersionUndefined))
+		if err != nil {
+			clock.Sleep(2 * time.Second)
+			continue
+		}
+
+		// Check if all required pods are ready
+		readyPods := make(map[string]bool)
+		for _, res := range list.Items {
+			status, ok := res.(*k8s.StaticPodStatus)
+			if !ok {
+				continue
+			}
+
+			// Extract pod name from ID (e.g., "kube-system/kube-apiserver-node")
+			id := res.Metadata().ID()
+			for _, required := range requiredPods {
+				if strings.Contains(id, required) {
+					// Check if pod is ready
+					podStatus := status.TypedSpec().PodStatus
+					if phase, ok := podStatus["phase"].(string); ok && phase == "Running" {
+						// Check conditions for Ready
+						if conditions, ok := podStatus["conditions"].([]any); ok {
+							for _, cond := range conditions {
+								if condMap, ok := cond.(map[string]any); ok {
+									if condMap["type"] == "Ready" && condMap["status"] == "True" {
+										readyPods[required] = true
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+
+		// Check if all required pods are ready
+		allReady := true
+		for _, pod := range requiredPods {
+			if !readyPods[pod] {
+				allReady = false
+				break
+			}
+		}
+
+		if allReady {
+			return nil
+		}
+
+		clock.Sleep(2 * time.Second)
+	}
+
+	return fmt.Errorf("timeout waiting for static pods to be healthy")
+}
+
+// waitForRunning polls for the node to come back up after reboot
+func (c *Client) waitForRunning(ctx context.Context, nodeIP string, remaining time.Duration, onProgress ProgressCallback) error {
+	clock := c.clock
+	if clock == nil {
+		clock = newRealClock()
+	}
+	if onProgress != nil {
+		onProgress(UpgradeProgress{Stage: "rebooting", Action: "waiting for node to come back"})
+	}
+
+	deadline := clock.Now().Add(remaining)
+	pollInterval := 2 * time.Second
+
+	for clock.Now().Before(deadline) {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-clock.After(pollInterval):
+		}
+
+		// Try to connect and check status
+		if c.IsReachable(ctx, nodeIP) {
+			// Node is back - try to watch for RUNNING state
+			nodeCtx := talosclient.WithNode(ctx, nodeIP)
+			eventCh := make(chan talosclient.EventResult, 10)
+
+			watchCtx, watchCancel := context.WithTimeout(nodeCtx, 10*time.Second)
+
+			go func() {
+				// Note: Do NOT close eventCh - SDK may still send after this returns
+				c.talos.EventsWatchV2(watchCtx, eventCh, talosclient.WithTailEvents(10))
+			}()
+
+			// Check recent events for machine status (with timeout)
+		eventLoop:
+			for {
+				select {
+				case <-watchCtx.Done():
+					break eventLoop
+				case result := <-eventCh:
+					if result.Error != nil {
+						break eventLoop
+					}
+
+					if progress := c.parseEvent(result.Event); progress != nil {
+						if onProgress != nil {
+							onProgress(*progress)
+						}
+						// In waitForRunning, we're already past the reboot so RUNNING means done
+						if progress.Stage == "running" {
+							watchCancel()
+							// Also verify k8s node is ready
+							if c.k8s == nil || c.isK8sNodeReady(ctx, nodeIP) {
+								return nil
+							}
+						}
+					}
+				}
+			}
+			watchCancel()
+
+			// If no RUNNING event but node is reachable and k8s ready, we're done
+			if c.k8s == nil || c.isK8sNodeReady(ctx, nodeIP) {
+				if onProgress != nil {
+					onProgress(UpgradeProgress{Stage: "running", Done: true})
+				}
+				return nil
+			}
+		}
+	}
+
+	return fmt.Errorf("timeout waiting for node %s to come back after reboot", nodeIP)
+}
+
+// GetClusterMembers discovers all nodes in the cluster by querying the Members resource.
+// This uses the default talosconfig endpoints to connect to the cluster.
+func (c *Client) GetClusterMembers(ctx context.Context) ([]ClusterMember, error) {
+	// Query Members resource - we need to query from any reachable node
+	// The SDK will use endpoints from talosconfig
+	list, err := c.talos.COSIList(ctx, resource.NewMetadata(cluster.NamespaceName, cluster.MemberType, "", resource.VersionUndefined))
+	if err != nil {
+		return nil, fmt.Errorf("failed to list cluster members: %w", err)
+	}
+
+	var members []ClusterMember
+	seen := make(map[string]bool)
+
+	for _, res := range list.Items {
+		member, ok := res.(*cluster.Member)
+		if !ok {
+			continue
+		}
+
+		spec := member.TypedSpec()
+		if len(spec.Addresses) == 0 {
+			continue
+		}
+
+		// Use the first IPv4 address as the primary IP
+		var primaryIP string
+		for _, addr := range spec.Addresses {
+			if addr.Is4() {
+				primaryIP = addr.String()
+				break
+			}
+		}
+		if primaryIP == "" {
+			primaryIP = spec.Addresses[0].String()
+		}
+
+		// Skip duplicates (members are replicated across all nodes)
+		if seen[primaryIP] {
+			continue
+		}
+		seen[primaryIP] = true
+
+		// Convert machine type to role string
+		role := "worker"
+		if spec.MachineType.String() == "controlplane" {
+			role = "controlplane"
+		}
+
+		members = append(members, ClusterMember{
+			IP:          primaryIP,
+			Hostname:    spec.Hostname,
+			Role:        role,
+			MachineType: spec.MachineType.String(),
+		})
+	}
+
+	return members, nil
+}
+
+// GetKernelCmdline retrieves the kernel command line from a node.
+func (c *Client) GetKernelCmdline(ctx context.Context, nodeIP string) (string, error) {
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+
+	list, err := c.talos.COSIList(nodeCtx, resource.NewMetadata(runtime.NamespaceName, runtime.KernelCmdlineType, "", resource.VersionUndefined))
+	if err != nil {
+		return "", fmt.Errorf("failed to get kernel cmdline: %w", err)
+	}
+
+	for _, res := range list.Items {
+		cmdline, ok := res.(*runtime.KernelCmdline)
+		if !ok {
+			continue
+		}
+		return cmdline.TypedSpec().Cmdline, nil
+	}
+
+	return "", fmt.Errorf("no kernel cmdline found")
+}
+
+// GetHardwareInfo retrieves hardware information from a node for profile detection.
+func (c *Client) GetHardwareInfo(ctx context.Context, nodeIP string) (*HardwareInfo, error) {
+	nodeCtx := talosclient.WithNode(ctx, nodeIP)
+	info := &HardwareInfo{}
+
+	// Query SystemInformation resource
+	sysInfoList, err := c.talos.COSIList(nodeCtx, resource.NewMetadata(hardware.NamespaceName, hardware.SystemInformationType, "", resource.VersionUndefined))
+	if err != nil {
+		return nil, fmt.Errorf("failed to get system information: %w", err)
+	}
+
+	for _, res := range sysInfoList.Items {
+		sysInfo, ok := res.(*hardware.SystemInformation)
+		if !ok {
+			continue
+		}
+		spec := sysInfo.TypedSpec()
+		info.SystemManufacturer = spec.Manufacturer
+		info.SystemProductName = spec.ProductName
+		break // Only one SystemInformation resource
+	}
+
+	// Query Processor resources
+	procList, err := c.talos.COSIList(nodeCtx, resource.NewMetadata(hardware.NamespaceName, hardware.ProcessorType, "", resource.VersionUndefined))
+	if err != nil {
+		return nil, fmt.Errorf("failed to get processor information: %w", err)
+	}
+
+	for _, res := range procList.Items {
+		proc, ok := res.(*hardware.Processor)
+		if !ok {
+			continue
+		}
+		spec := proc.TypedSpec()
+		// Take the first processor with manufacturer info
+		if spec.Manufacturer != "" {
+			info.ProcessorManufacturer = spec.Manufacturer
+			info.ProcessorProductName = spec.ProductName
+			break
+		}
+	}
+
+	return info, nil
+}

internal/talos/client_test.go

···
+package talos
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/talos/pkg/machinery/api/common"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	talosclient "github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+// ============================================================================
+// MockClient Tests
+// ============================================================================
+
+func TestMockClient_DefaultBehavior(t *testing.T) {
+	mock := &MockClient{}
+
+	t.Run("Close returns nil", func(t *testing.T) {
+		err := mock.Close()
+		assert.NoError(t, err)
+	})
+
+	t.Run("GetVersion returns default", func(t *testing.T) {
+		version, err := mock.GetVersion(context.Background(), "192.168.1.1")
+		require.NoError(t, err)
+		assert.Equal(t, "1.7.0", version)
+	})
+
+	t.Run("GetMachineType returns unknown", func(t *testing.T) {
+		machineType, err := mock.GetMachineType(context.Background(), "192.168.1.1")
+		require.NoError(t, err)
+		assert.Equal(t, "unknown", machineType)
+	})
+
+	t.Run("IsReachable returns true", func(t *testing.T) {
+		reachable := mock.IsReachable(context.Background(), "192.168.1.1")
+		assert.True(t, reachable)
+	})
+
+	t.Run("Upgrade returns nil", func(t *testing.T) {
+		err := mock.Upgrade(context.Background(), "192.168.1.1", "image:v1.7.0", true)
+		assert.NoError(t, err)
+	})
+
+	t.Run("WaitForNode returns nil", func(t *testing.T) {
+		err := mock.WaitForNode(context.Background(), "192.168.1.1", time.Minute)
+		assert.NoError(t, err)
+	})
+
+	t.Run("GetNodeStatus returns populated status", func(t *testing.T) {
+		status := mock.GetNodeStatus(context.Background(), "192.168.1.1", "profile-a", "worker", true)
+		assert.Equal(t, "192.168.1.1", status.IP)
+		assert.Equal(t, "profile-a", status.Profile)
+		assert.Equal(t, "worker", status.Role)
+		assert.Equal(t, "1.7.0", status.Version)
+		assert.True(t, status.Secureboot)
+		assert.True(t, status.Reachable)
+	})
+
+	t.Run("WatchUpgrade returns nil", func(t *testing.T) {
+		err := mock.WatchUpgrade(context.Background(), "192.168.1.1", time.Minute, nil)
+		assert.NoError(t, err)
+	})
+
+	t.Run("WaitForServices returns nil", func(t *testing.T) {
+		err := mock.WaitForServices(context.Background(), "192.168.1.1", []string{"etcd", "kubelet"}, time.Minute)
+		assert.NoError(t, err)
+	})
+
+	t.Run("WaitForStaticPods returns nil", func(t *testing.T) {
+		err := mock.WaitForStaticPods(context.Background(), "192.168.1.1", time.Minute)
+		assert.NoError(t, err)
+	})
+}
+
+func TestMockClient_CustomFunctions(t *testing.T) {
+	t.Run("custom GetVersion", func(t *testing.T) {
+		mock := &MockClient{
+			GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+				if nodeIP == "192.168.1.1" {
+					return "1.8.0", nil
+				}
+				return "", errors.New("node not found")
+			},
+		}
+
+		version, err := mock.GetVersion(context.Background(), "192.168.1.1")
+		require.NoError(t, err)
+		assert.Equal(t, "1.8.0", version)
+
+		_, err = mock.GetVersion(context.Background(), "192.168.1.99")
+		assert.Error(t, err)
+	})
+
+	t.Run("custom IsReachable", func(t *testing.T) {
+		unreachableNodes := map[string]bool{"192.168.1.2": true}
+		mock := &MockClient{
+			IsReachableFunc: func(ctx context.Context, nodeIP string) bool {
+				return !unreachableNodes[nodeIP]
+			},
+		}
+
+		assert.True(t, mock.IsReachable(context.Background(), "192.168.1.1"))
+		assert.False(t, mock.IsReachable(context.Background(), "192.168.1.2"))
+	})
+
+	t.Run("custom Upgrade with error", func(t *testing.T) {
+		mock := &MockClient{
+			UpgradeFunc: func(ctx context.Context, nodeIP, image string, preserve bool) error {
+				return errors.New("upgrade failed")
+			},
+		}
+
+		err := mock.Upgrade(context.Background(), "192.168.1.1", "image:v1.7.0", true)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "upgrade failed")
+	})
+
+	t.Run("custom WaitForNode timeout", func(t *testing.T) {
+		mock := &MockClient{
+			WaitForNodeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration) error {
+				return errors.New("timeout waiting for node")
+			},
+		}
+
+		err := mock.WaitForNode(context.Background(), "192.168.1.1", time.Minute)
+		assert.Error(t, err)
+	})
+
+	t.Run("custom GetNodeStatus unreachable", func(t *testing.T) {
+		mock := &MockClient{
+			GetNodeStatusFunc: func(ctx context.Context, nodeIP, profile, role string, secureboot bool) NodeStatus {
+				return NodeStatus{
+					IP:        nodeIP,
+					Profile:   profile,
+					Role:      role,
+					Version:   "N/A",
+					Reachable: false,
+				}
+			},
+		}
+
+		status := mock.GetNodeStatus(context.Background(), "192.168.1.1", "test", "worker", false)
+		assert.False(t, status.Reachable)
+		assert.Equal(t, "N/A", status.Version)
+	})
+
+	t.Run("custom WatchUpgrade with callback", func(t *testing.T) {
+		var callbackCalls []UpgradeProgress
+		mock := &MockClient{
+			WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, onProgress ProgressCallback) error {
+				// Simulate progress events
+				if onProgress != nil {
+					onProgress(UpgradeProgress{Stage: "upgrading", Phase: "prepare"})
+					onProgress(UpgradeProgress{Stage: "rebooting"})
+					onProgress(UpgradeProgress{Stage: "running", Done: true})
+				}
+				return nil
+			},
+		}
+
+		err := mock.WatchUpgrade(context.Background(), "192.168.1.1", time.Minute, func(p UpgradeProgress) {
+			callbackCalls = append(callbackCalls, p)
+		})
+		require.NoError(t, err)
+		assert.Len(t, callbackCalls, 3)
+		assert.Equal(t, "upgrading", callbackCalls[0].Stage)
+		assert.Equal(t, "running", callbackCalls[2].Stage)
+		assert.True(t, callbackCalls[2].Done)
+	})
+
+	t.Run("custom WaitForServices with error", func(t *testing.T) {
+		mock := &MockClient{
+			WaitForServicesFunc: func(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+				return errors.New("service not healthy")
+			},
+		}
+		err := mock.WaitForServices(context.Background(), "192.168.1.1", []string{"etcd"}, time.Minute)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "service not healthy")
+	})
+
+	t.Run("custom WaitForStaticPods with error", func(t *testing.T) {
+		mock := &MockClient{
+			WaitForStaticPodsFunc: func(ctx context.Context, nodeIP string, timeout time.Duration) error {
+				return errors.New("pods not ready")
+			},
+		}
+		err := mock.WaitForStaticPods(context.Background(), "192.168.1.1", time.Minute)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "pods not ready")
+	})
+}
+
+// ============================================================================
+// NodeStatus Tests
+// ============================================================================
+
+func TestNodeStatus_Struct(t *testing.T) {
+	status := NodeStatus{
+		IP:          "192.168.1.1",
+		Profile:     "amd64-intel",
+		Role:        "controlplane",
+		Version:     "1.7.0",
+		MachineType: "controlplane",
+		Secureboot:  true,
+		Reachable:   true,
+	}
+
+	assert.Equal(t, "192.168.1.1", status.IP)
+	assert.Equal(t, "amd64-intel", status.Profile)
+	assert.Equal(t, "controlplane", status.Role)
+	assert.Equal(t, "1.7.0", status.Version)
+	assert.Equal(t, "controlplane", status.MachineType)
+	assert.True(t, status.Secureboot)
+	assert.True(t, status.Reachable)
+}
+
+func TestNodeStatus_Unreachable(t *testing.T) {
+	status := NodeStatus{
+		IP:          "192.168.1.99",
+		Profile:     "unknown",
+		Role:        "worker",
+		Version:     "N/A",
+		MachineType: "unknown",
+		Secureboot:  false,
+		Reachable:   false,
+	}
+
+	assert.Equal(t, "192.168.1.99", status.IP)
+	assert.Equal(t, "N/A", status.Version)
+	assert.False(t, status.Reachable)
+}
+
+// ============================================================================
+// UpgradeProgress Tests
+// ============================================================================
+
+func TestUpgradeProgress_Struct(t *testing.T) {
+	progress := UpgradeProgress{
+		Stage:  "upgrading",
+		Phase:  "install",
+		Task:   "downloading image",
+		Action: "START",
+		Done:   false,
+	}
+
+	assert.Equal(t, "upgrading", progress.Stage)
+	assert.Equal(t, "install", progress.Phase)
+	assert.Equal(t, "downloading image", progress.Task)
+	assert.Equal(t, "START", progress.Action)
+	assert.False(t, progress.Done)
+}
+
+func TestUpgradeProgress_Done(t *testing.T) {
+	progress := UpgradeProgress{
+		Stage: "running",
+		Done:  true,
+	}
+
+	assert.True(t, progress.Done)
+}
+
+func TestUpgradeProgress_Error(t *testing.T) {
+	progress := UpgradeProgress{
+		Stage: "upgrading",
+		Error: "failed to download image",
+	}
+
+	assert.NotEmpty(t, progress.Error)
+}
+
+// ============================================================================
+// Interface Compliance Tests
+// ============================================================================
+
+func TestMockClient_ImplementsInterface(t *testing.T) {
+	// This test verifies that MockClient implements TalosClientInterface
+	var client TalosClientInterface = &MockClient{}
+	assert.NotNil(t, client)
+}
+
+// ============================================================================
+// Context Handling Tests
+// ============================================================================
+
+func TestMockClient_ContextCancellation(t *testing.T) {
+	mock := &MockClient{
+		WaitForNodeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration) error {
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case <-time.After(timeout):
+				return nil
+			}
+		},
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // Cancel immediately
+
+	err := mock.WaitForNode(ctx, "192.168.1.1", time.Hour)
+	assert.Error(t, err)
+	assert.Equal(t, context.Canceled, err)
+}
+
+func TestMockClient_ContextTimeout(t *testing.T) {
+	mock := &MockClient{
+		WaitForNodeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration) error {
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case <-time.After(time.Second): // Simulates long operation
+				return nil
+			}
+		},
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
+	defer cancel()
+
+	err := mock.WaitForNode(ctx, "192.168.1.1", time.Hour)
+	assert.Error(t, err)
+	assert.Equal(t, context.DeadlineExceeded, err)
+}
+
+// ============================================================================
+// Upgrade Workflow Simulation Tests
+// ============================================================================
+
+func TestMockClient_SimulateUpgradeWorkflow(t *testing.T) {
+	// Track upgrade state
+	upgradeStarted := false
+	nodeVersion := "1.6.0"
+
+	mock := &MockClient{
+		GetVersionFunc: func(ctx context.Context, nodeIP string) (string, error) {
+			return nodeVersion, nil
+		},
+		UpgradeFunc: func(ctx context.Context, nodeIP, image string, preserve bool) error {
+			upgradeStarted = true
+			return nil
+		},
+		WatchUpgradeFunc: func(ctx context.Context, nodeIP string, timeout time.Duration, onProgress ProgressCallback) error {
+			if !upgradeStarted {
+				return errors.New("upgrade not started")
+			}
+			// Simulate upgrade completing
+			nodeVersion = "1.7.0"
+			if onProgress != nil {
+				onProgress(UpgradeProgress{Stage: "running", Done: true})
+			}
+			return nil
+		},
+	}
+
+	ctx := context.Background()
+
+	// Check initial version
+	version, err := mock.GetVersion(ctx, "192.168.1.1")
+	require.NoError(t, err)
+	assert.Equal(t, "1.6.0", version)
+
+	// Start upgrade
+	err = mock.Upgrade(ctx, "192.168.1.1", "image:v1.7.0", true)
+	require.NoError(t, err)
+	assert.True(t, upgradeStarted)
+
+	// Watch for completion
+	var finalProgress UpgradeProgress
+	err = mock.WatchUpgrade(ctx, "192.168.1.1", time.Minute, func(p UpgradeProgress) {
+		finalProgress = p
+	})
+	require.NoError(t, err)
+	assert.True(t, finalProgress.Done)
+
+	// Check new version
+	version, err = mock.GetVersion(ctx, "192.168.1.1")
+	require.NoError(t, err)
+	assert.Equal(t, "1.7.0", version)
+}
+
+// ============================================================================
+// Service List Tests
+// ============================================================================
+
+func TestGetControlPlaneServices(t *testing.T) {
+	services := GetControlPlaneServices()
+	expected := []string{"etcd", "kubelet", "apid", "trustd"}
+	assert.Equal(t, expected, services)
+	assert.Len(t, services, 4)
+}
+
+func TestGetWorkerServices(t *testing.T) {
+	services := GetWorkerServices()
+	expected := []string{"kubelet", "apid", "trustd"}
+	assert.Equal(t, expected, services)
+	assert.Len(t, services, 3)
+}
+
+// ============================================================================
+// parseEvent Tests
+// ============================================================================
+
+func TestParseEvent_SequenceEvent(t *testing.T) {
+	c := &Client{} // nil talos/k8s clients are fine - parseEvent doesn't use them
+
+	t.Run("sequence start", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.SequenceEvent{
+				Sequence: "upgrade",
+				Action:   machine.SequenceEvent_START,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "upgrade", progress.Phase)
+		assert.Equal(t, "START", progress.Action)
+		assert.Empty(t, progress.Error)
+	})
+
+	t.Run("sequence stop", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.SequenceEvent{
+				Sequence: "reboot",
+				Action:   machine.SequenceEvent_STOP,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "reboot", progress.Phase)
+		assert.Equal(t, "STOP", progress.Action)
+	})
+
+	t.Run("sequence with error", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.SequenceEvent{
+				Sequence: "upgrade",
+				Action:   machine.SequenceEvent_START,
+				Error: &common.Error{
+					Message: "upgrade failed: disk full",
+				},
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "upgrade failed: disk full", progress.Error)
+	})
+}
+
+func TestParseEvent_PhaseEvent(t *testing.T) {
+	c := &Client{}
+
+	t.Run("phase start", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.PhaseEvent{
+				Phase:  "install",
+				Action: machine.PhaseEvent_START,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "install", progress.Phase)
+		assert.Equal(t, "START", progress.Action)
+	})
+
+	t.Run("phase stop", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.PhaseEvent{
+				Phase:  "boot",
+				Action: machine.PhaseEvent_STOP,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "boot", progress.Phase)
+		assert.Equal(t, "STOP", progress.Action)
+	})
+}
+
+func TestParseEvent_TaskEvent(t *testing.T) {
+	c := &Client{}
+
+	t.Run("task start", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.TaskEvent{
+				Task:   "downloading image",
+				Action: machine.TaskEvent_START,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "downloading image", progress.Task)
+		assert.Equal(t, "START", progress.Action)
+	})
+
+	t.Run("task stop", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.TaskEvent{
+				Task:   "writing disk",
+				Action: machine.TaskEvent_STOP,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "writing disk", progress.Task)
+		assert.Equal(t, "STOP", progress.Action)
+	})
+}
+
+func TestParseEvent_MachineStatusEvent(t *testing.T) {
+	c := &Client{}
+
+	t.Run("running state", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.MachineStatusEvent{
+				Stage: machine.MachineStatusEvent_RUNNING,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "running", progress.Stage)
+		// Note: parseEvent no longer sets Done - caller decides based on context
+		assert.False(t, progress.Done)
+	})
+
+	t.Run("booting state", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.MachineStatusEvent{
+				Stage: machine.MachineStatusEvent_BOOTING,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "booting", progress.Stage)
+		assert.False(t, progress.Done)
+	})
+
+	t.Run("upgrading state", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.MachineStatusEvent{
+				Stage: machine.MachineStatusEvent_UPGRADING,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "upgrading", progress.Stage)
+		assert.False(t, progress.Done)
+	})
+
+	t.Run("rebooting state", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: &machine.MachineStatusEvent{
+				Stage: machine.MachineStatusEvent_REBOOTING,
+			},
+		}
+		progress := c.parseEvent(event)
+		require.NotNil(t, progress)
+		assert.Equal(t, "rebooting", progress.Stage)
+		assert.False(t, progress.Done)
+	})
+}
+
+func TestParseEvent_UnknownPayload(t *testing.T) {
+	c := &Client{}
+
+	t.Run("unknown proto message returns nil", func(t *testing.T) {
+		// Use a proto message type that isn't handled in the switch
+		event := talosclient.Event{
+			Payload: &machine.Version{},
+		}
+		progress := c.parseEvent(event)
+		assert.Nil(t, progress)
+	})
+
+	t.Run("nil payload returns nil", func(t *testing.T) {
+		event := talosclient.Event{
+			Payload: nil,
+		}
+		progress := c.parseEvent(event)
+		assert.Nil(t, progress)
+	})
+}
+
+// ============================================================================
+// K8s Client Tests (using fake clientset)
+// ============================================================================
+
+// makeNode creates a K8s Node for testing
+func makeNode(name, ip string, ready bool) *corev1.Node {
+	status := corev1.ConditionFalse
+	if ready {
+		status = corev1.ConditionTrue
+	}
+	return &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{Name: name},
+		Status: corev1.NodeStatus{
+			Addresses: []corev1.NodeAddress{
+				{Type: corev1.NodeInternalIP, Address: ip},
+			},
+			Conditions: []corev1.NodeCondition{
+				{Type: corev1.NodeReady, Status: status},
+			},
+		},
+	}
+}
+
+func TestIsK8sNodeReady(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("nil k8s client returns true", func(t *testing.T) {
+		c := &Client{k8s: nil}
+		assert.True(t, c.isK8sNodeReady(ctx, "192.168.1.1"))
+	})
+
+	t.Run("node ready", func(t *testing.T) {
+		fakeClient := fake.NewSimpleClientset(makeNode("node1", "192.168.1.1", true))
+		c := &Client{k8s: fakeClient}
+		assert.True(t, c.isK8sNodeReady(ctx, "192.168.1.1"))
+	})
+
+	t.Run("node not ready", func(t *testing.T) {
+		fakeClient := fake.NewSimpleClientset(makeNode("node1", "192.168.1.1", false))
+		c := &Client{k8s: fakeClient}
+		assert.False(t, c.isK8sNodeReady(ctx, "192.168.1.1"))
+	})
+
+	t.Run("node not found", func(t *testing.T) {
+		fakeClient := fake.NewSimpleClientset(makeNode("node1", "192.168.1.99", true))
+		c := &Client{k8s: fakeClient}
+		assert.False(t, c.isK8sNodeReady(ctx, "192.168.1.1"))
+	})
+
+	t.Run("empty cluster", func(t *testing.T) {
+		fakeClient := fake.NewSimpleClientset()
+		c := &Client{k8s: fakeClient}
+		assert.False(t, c.isK8sNodeReady(ctx, "192.168.1.1"))
+	})
+
+	t.Run("multiple nodes finds correct one", func(t *testing.T) {
+		fakeClient := fake.NewSimpleClientset(
+			makeNode("node1", "192.168.1.1", false),
+			makeNode("node2", "192.168.1.2", true),
+			makeNode("node3", "192.168.1.3", true),
+		)
+		c := &Client{k8s: fakeClient}
+		assert.False(t, c.isK8sNodeReady(ctx, "192.168.1.1"))
+		assert.True(t, c.isK8sNodeReady(ctx, "192.168.1.2"))
+		assert.True(t, c.isK8sNodeReady(ctx, "192.168.1.3"))
+	})
+}
+
+func TestGetK8sNodeName(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("nil k8s client returns empty", func(t *testing.T) {
+		c := &Client{k8s: nil}
+		assert.Equal(t, "", c.GetK8sNodeName(ctx, "192.168.1.1"))
+	})
+
+	t.Run("node found", func(t *testing.T) {
+		fakeClient := fake.NewSimpleClientset(makeNode("my-node", "192.168.1.1", true))
+		c := &Client{k8s: fakeClient}
+		assert.Equal(t, "my-node", c.GetK8sNodeName(ctx, "192.168.1.1"))
+	})
+
+	t.Run("node not found", func(t *testing.T) {
+		fakeClient := fake.NewSimpleClientset(makeNode("node1", "192.168.1.99", true))
+		c := &Client{k8s: fakeClient}
+		assert.Equal(t, "", c.GetK8sNodeName(ctx, "192.168.1.1"))
+	})
+
+	t.Run("multiple nodes finds correct one", func(t *testing.T) {
+		fakeClient := fake.NewSimpleClientset(
+			makeNode("controlplane-1", "192.168.1.1", true),
+			makeNode("worker-1", "192.168.1.2", true),
+			makeNode("worker-2", "192.168.1.3", true),
+		)
+		c := &Client{k8s: fakeClient}
+		assert.Equal(t, "controlplane-1", c.GetK8sNodeName(ctx, "192.168.1.1"))
+		assert.Equal(t, "worker-1", c.GetK8sNodeName(ctx, "192.168.1.2"))
+		assert.Equal(t, "worker-2", c.GetK8sNodeName(ctx, "192.168.1.3"))
+		assert.Equal(t, "", c.GetK8sNodeName(ctx, "192.168.1.99"))
+	})
+}
+
+// ============================================================================
+// SDK-Dependent Function Tests (using MockTalosMachineClient)
+// ============================================================================
+
+func TestClient_GetVersion(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("success with v prefix", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: &machine.VersionInfo{Tag: "v1.8.0"}},
+					},
+				}, nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		version, err := c.GetVersion(ctx, "192.168.1.1")
+		require.NoError(t, err)
+		assert.Equal(t, "1.8.0", version)
+	})
+
+	t.Run("success without v prefix", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: &machine.VersionInfo{Tag: "1.7.5"}},
+					},
+				}, nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		version, err := c.GetVersion(ctx, "192.168.1.1")
+		require.NoError(t, err)
+		assert.Equal(t, "1.7.5", version)
+	})
+
+	t.Run("error from SDK", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return nil, errors.New("connection refused")
+			},
+		}
+		c := &Client{talos: mockTalos}
+		_, err := c.GetVersion(ctx, "192.168.1.1")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to get version")
+	})
+
+	t.Run("empty messages", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{Messages: []*machine.Version{}}, nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		_, err := c.GetVersion(ctx, "192.168.1.1")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "no version in response")
+	})
+
+	t.Run("nil version in message", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: nil},
+					},
+				}, nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		_, err := c.GetVersion(ctx, "192.168.1.1")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "no version in response")
+	})
+
+	t.Run("empty tag", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: &machine.VersionInfo{Tag: ""}},
+					},
+				}, nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		version, err := c.GetVersion(ctx, "192.168.1.1")
+		require.NoError(t, err)
+		assert.Equal(t, "", version)
+	})
+}
+
+func TestClient_GetMachineType(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("returns unknown by design", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{
+							Version:  &machine.VersionInfo{Tag: "v1.7.0"},
+							Platform: &machine.PlatformInfo{Name: "metal"},
+						},
+					},
+				}, nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		machineType, err := c.GetMachineType(ctx, "192.168.1.1")
+		require.NoError(t, err)
+		assert.Equal(t, "unknown", machineType)
+	})
+
+	t.Run("error from SDK", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return nil, errors.New("connection refused")
+			},
+		}
+		c := &Client{talos: mockTalos}
+		_, err := c.GetMachineType(ctx, "192.168.1.1")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to get version")
+	})
+}
+
+func TestClient_IsReachable(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("reachable node", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: &machine.VersionInfo{Tag: "v1.7.0"}},
+					},
+				}, nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		assert.True(t, c.IsReachable(ctx, "192.168.1.1"))
+	})
+
+	t.Run("unreachable node", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return nil, errors.New("connection refused")
+			},
+		}
+		c := &Client{talos: mockTalos}
+		assert.False(t, c.IsReachable(ctx, "192.168.1.1"))
+	})
+}
+
+func TestClient_Upgrade(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("success", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			UpgradeWithOptionsFunc: func(ctx context.Context, opts ...talosclient.UpgradeOption) (*machine.UpgradeResponse, error) {
+				return &machine.UpgradeResponse{}, nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		err := c.Upgrade(ctx, "192.168.1.1", "ghcr.io/siderolabs/installer:v1.8.0", true)
+		require.NoError(t, err)
+	})
+
+	t.Run("error from SDK", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			UpgradeWithOptionsFunc: func(ctx context.Context, opts ...talosclient.UpgradeOption) (*machine.UpgradeResponse, error) {
+				return nil, errors.New("upgrade in progress")
+			},
+		}
+		c := &Client{talos: mockTalos}
+		err := c.Upgrade(ctx, "192.168.1.1", "ghcr.io/siderolabs/installer:v1.8.0", false)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "upgrade failed")
+	})
+}
+
+func TestClient_Close(t *testing.T) {
+	t.Run("nil talos client", func(t *testing.T) {
+		c := &Client{talos: nil}
+		err := c.Close()
+		require.NoError(t, err)
+	})
+
+	t.Run("close success", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			CloseFunc: func() error {
+				return nil
+			},
+		}
+		c := &Client{talos: mockTalos}
+		err := c.Close()
+		require.NoError(t, err)
+	})
+
+	t.Run("close error", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			CloseFunc: func() error {
+				return errors.New("close failed")
+			},
+		}
+		c := &Client{talos: mockTalos}
+		err := c.Close()
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "close failed")
+	})
+}
+
+func TestClient_GetNodeStatus(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("reachable node with version", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: &machine.VersionInfo{Tag: "v1.8.0"}},
+					},
+				}, nil
+			},
+		}
+		c := &Client{talos: mockTalos, k8s: nil}
+		status := c.GetNodeStatus(ctx, "192.168.1.1", "amd64-intel", "controlplane", true)
+
+		assert.Equal(t, "192.168.1.1", status.IP)
+		assert.Equal(t, "amd64-intel", status.Profile)
+		assert.Equal(t, "controlplane", status.Role)
+		assert.Equal(t, "1.8.0", status.Version)
+		assert.Equal(t, "unknown", status.MachineType)
+		assert.True(t, status.Secureboot)
+		assert.True(t, status.Reachable)
+	})
+
+	t.Run("unreachable node", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return nil, errors.New("connection refused")
+			},
+		}
+		c := &Client{talos: mockTalos, k8s: nil}
+		status := c.GetNodeStatus(ctx, "192.168.1.1", "amd64-intel", "worker", false)
+
+		assert.Equal(t, "192.168.1.1", status.IP)
+		assert.Equal(t, "amd64-intel", status.Profile)
+		assert.Equal(t, "worker", status.Role)
+		assert.Equal(t, "N/A", status.Version)
+		assert.Equal(t, "unknown", status.MachineType)
+		assert.False(t, status.Secureboot)
+		assert.False(t, status.Reachable)
+	})
+}
+
+// ============================================================================
+// MockTalosMachineClient Tests
+// ============================================================================
+
+func TestMockTalosMachineClient_DefaultBehavior(t *testing.T) {
+	mock := &MockTalosMachineClient{}
+	ctx := context.Background()
+
+	t.Run("Close returns nil", func(t *testing.T) {
+		err := mock.Close()
+		assert.NoError(t, err)
+	})
+
+	t.Run("Version returns default", func(t *testing.T) {
+		resp, err := mock.Version(ctx)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Len(t, resp.Messages, 1)
+		assert.Equal(t, "v1.7.0", resp.Messages[0].Version.Tag)
+	})
+
+	t.Run("UpgradeWithOptions returns empty response", func(t *testing.T) {
+		resp, err := mock.UpgradeWithOptions(ctx)
+		require.NoError(t, err)
+		assert.NotNil(t, resp)
+	})
+
+	t.Run("ServiceInfo returns empty slice", func(t *testing.T) {
+		resp, err := mock.ServiceInfo(ctx, "etcd")
+		require.NoError(t, err)
+		assert.Empty(t, resp)
+	})
+
+	t.Run("EventsWatchV2 returns nil", func(t *testing.T) {
+		eventCh := make(chan talosclient.EventResult, 10)
+		err := mock.EventsWatchV2(ctx, eventCh)
+		assert.NoError(t, err)
+	})
+
+	t.Run("COSIList returns empty list", func(t *testing.T) {
+		list, err := mock.COSIList(ctx, resource.NewMetadata("test", "type", "id", resource.VersionUndefined))
+		require.NoError(t, err)
+		assert.Empty(t, list.Items)
+	})
+}
+
+func TestMockTalosMachineClient_ImplementsInterface(t *testing.T) {
+	var client TalosMachineClient = &MockTalosMachineClient{}
+	assert.NotNil(t, client)
+}
+
+// ============================================================================
+// Clock-Based Tests for Timeout Functions
+// ============================================================================
+
+func TestClient_WaitForNode(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("returns immediately when node is reachable", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: &machine.VersionInfo{Tag: "v1.7.0"}},
+					},
+				}, nil
+			},
+		}
+		mockClock := NewMockClock(time.Now())
+
+		c := &Client{talos: mockTalos, k8s: nil, clock: mockClock}
+		err := c.WaitForNode(ctx, "192.168.1.1", time.Minute)
+		require.NoError(t, err)
+	})
+
+	t.Run("times out when node is unreachable", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return nil, errors.New("connection refused")
+			},
+		}
+		startTime := time.Now()
+		mockClock := &MockClock{
+			CurrentTime:    startTime,
+			AdvanceOnAfter: true,
+		}
+		// Mock clock that advances time on each Sleep call
+		sleepCount := 0
+		mockClock.SleepFunc = func(d time.Duration) {
+			sleepCount++
+			mockClock.CurrentTime = mockClock.CurrentTime.Add(d)
+		}
+
+		c := &Client{talos: mockTalos, k8s: nil, clock: mockClock}
+		err := c.WaitForNode(ctx, "192.168.1.1", 30*time.Second)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "timeout waiting for node")
+		// Verify multiple retries occurred (5 second sleep, 30 second timeout = ~6 retries)
+		assert.GreaterOrEqual(t, sleepCount, 5, "expected at least 5 sleep calls")
+	})
+
+	t.Run("context cancellation", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return nil, errors.New("connection refused")
+			},
+		}
+		mockClock := NewMockClock(time.Now())
+
+		c := &Client{talos: mockTalos, k8s: nil, clock: mockClock}
+
+		canceledCtx, cancel := context.WithCancel(ctx)
+		cancel()
+
+		err := c.WaitForNode(canceledCtx, "192.168.1.1", time.Minute)
+		require.Error(t, err)
+		assert.Equal(t, context.Canceled, err)
+	})
+
+	t.Run("node reachable but k8s not ready then becomes ready", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: &machine.VersionInfo{Tag: "v1.7.0"}},
+					},
+				}, nil
+			},
+		}
+
+		// Start with unready node, then make it ready
+		k8sReady := false
+		fakeClient := fake.NewSimpleClientset(makeNode("node1", "192.168.1.1", false))
+
+		mockClock := NewMockClock(time.Now())
+		mockClock.SleepFunc = func(d time.Duration) {
+			mockClock.CurrentTime = mockClock.CurrentTime.Add(d)
+			// After first sleep, make k8s node ready
+			if !k8sReady {
+				k8sReady = true
+				// Update the fake client's node to be ready
+				node := makeNode("node1", "192.168.1.1", true)
+				fakeClient.CoreV1().Nodes().Update(ctx, node, metav1.UpdateOptions{})
+			}
+		}
+
+		c := &Client{talos: mockTalos, k8s: fakeClient, clock: mockClock}
+		err := c.WaitForNode(ctx, "192.168.1.1", time.Minute)
+		require.NoError(t, err)
+	})
+}
+
+func TestClient_WaitForServices(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("returns immediately when all services are healthy", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			ServiceInfoFunc: func(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+				return []talosclient.ServiceInfo{
+					{
+						Service: &machine.ServiceInfo{
+							Id:     service,
+							State:  "Running",
+							Health: &machine.ServiceHealth{Healthy: true},
+						},
+					},
+				}, nil
+			},
+		}
+		mockClock := NewMockClock(time.Now())
+
+		c := &Client{talos: mockTalos, clock: mockClock}
+		err := c.WaitForServices(ctx, "192.168.1.1", []string{"etcd", "kubelet"}, time.Minute)
+		require.NoError(t, err)
+	})
+
+	t.Run("times out when service is unhealthy", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			ServiceInfoFunc: func(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+				return []talosclient.ServiceInfo{
+					{
+						Service: &machine.ServiceInfo{
+							Id:     service,
+							State:  "Running",
+							Health: &machine.ServiceHealth{Healthy: false},
+						},
+					},
+				}, nil
+			},
+		}
+		startTime := time.Now()
+		mockClock := &MockClock{CurrentTime: startTime}
+		mockClock.SleepFunc = func(d time.Duration) {
+			mockClock.CurrentTime = mockClock.CurrentTime.Add(d)
+		}
+
+		c := &Client{talos: mockTalos, clock: mockClock}
+		err := c.WaitForServices(ctx, "192.168.1.1", []string{"etcd"}, 10*time.Second)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "timeout waiting for services")
+	})
+
+	t.Run("times out when service is not running", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			ServiceInfoFunc: func(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+				return []talosclient.ServiceInfo{
+					{
+						Service: &machine.ServiceInfo{
+							Id:     service,
+							State:  "Starting",
+							Health: nil,
+						},
+					},
+				}, nil
+			},
+		}
+		startTime := time.Now()
+		mockClock := &MockClock{CurrentTime: startTime}
+		mockClock.SleepFunc = func(d time.Duration) {
+			mockClock.CurrentTime = mockClock.CurrentTime.Add(d)
+		}
+
+		c := &Client{talos: mockTalos, clock: mockClock}
+		err := c.WaitForServices(ctx, "192.168.1.1", []string{"etcd"}, 10*time.Second)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "timeout waiting for services")
+	})
+
+	t.Run("times out when service info errors", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			ServiceInfoFunc: func(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+				return nil, errors.New("service not found")
+			},
+		}
+		startTime := time.Now()
+		mockClock := &MockClock{CurrentTime: startTime}
+		mockClock.SleepFunc = func(d time.Duration) {
+			mockClock.CurrentTime = mockClock.CurrentTime.Add(d)
+		}
+
+		c := &Client{talos: mockTalos, clock: mockClock}
+		err := c.WaitForServices(ctx, "192.168.1.1", []string{"etcd"}, 10*time.Second)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "timeout waiting for services")
+	})
+
+	t.Run("context cancellation", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			ServiceInfoFunc: func(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+				return nil, errors.New("service not found")
+			},
+		}
+		mockClock := NewMockClock(time.Now())
+
+		c := &Client{talos: mockTalos, clock: mockClock}
+
+		canceledCtx, cancel := context.WithCancel(ctx)
+		cancel()
+
+		err := c.WaitForServices(canceledCtx, "192.168.1.1", []string{"etcd"}, time.Minute)
+		require.Error(t, err)
+		assert.Equal(t, context.Canceled, err)
+	})
+
+	t.Run("service becomes healthy after retry", func(t *testing.T) {
+		attempts := 0
+		mockTalos := &MockTalosMachineClient{
+			ServiceInfoFunc: func(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+				attempts++
+				if attempts < 3 {
+					return []talosclient.ServiceInfo{
+						{
+							Service: &machine.ServiceInfo{
+								Id:     service,
+								State:  "Starting",
+								Health: nil,
+							},
+						},
+					}, nil
+				}
+				return []talosclient.ServiceInfo{
+					{
+						Service: &machine.ServiceInfo{
+							Id:     service,
+							State:  "Running",
+							Health: &machine.ServiceHealth{Healthy: true},
+						},
+					},
+				}, nil
+			},
+		}
+		mockClock := NewMockClock(time.Now())
+		mockClock.SleepFunc = func(d time.Duration) {
+			mockClock.CurrentTime = mockClock.CurrentTime.Add(d)
+		}
+
+		c := &Client{talos: mockTalos, clock: mockClock}
+		err := c.WaitForServices(ctx, "192.168.1.1", []string{"etcd"}, time.Minute)
+		require.NoError(t, err)
+		assert.Equal(t, 3, attempts)
+	})
+}
+
+// ============================================================================
+// MockClock Tests
+// ============================================================================
+
+func TestMockClock(t *testing.T) {
+	t.Run("Now returns CurrentTime", func(t *testing.T) {
+		now := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
+		clock := NewMockClock(now)
+		assert.Equal(t, now, clock.Now())
+	})
+
+	t.Run("Advance moves time forward", func(t *testing.T) {
+		now := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
+		clock := NewMockClock(now)
+		clock.Advance(time.Hour)
+		assert.Equal(t, now.Add(time.Hour), clock.Now())
+	})
+
+	t.Run("Sleep advances time", func(t *testing.T) {
+		now := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
+		clock := NewMockClock(now)
+		clock.Sleep(5 * time.Second)
+		assert.Equal(t, now.Add(5*time.Second), clock.Now())
+	})
+
+	t.Run("After returns immediately with value", func(t *testing.T) {
+		now := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
+		clock := NewMockClock(now)
+
+		ch := clock.After(time.Second)
+		select {
+		case receivedTime := <-ch:
+			assert.Equal(t, now, receivedTime)
+		default:
+			assert.Fail(t, "After should return immediately in mock")
+		}
+	})
+
+	t.Run("AdvanceOnAfter option", func(t *testing.T) {
+		now := time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
+		clock := &MockClock{
+			CurrentTime:    now,
+			AdvanceOnAfter: true,
+		}
+
+		clock.After(5 * time.Second)
+		assert.Equal(t, now.Add(5*time.Second), clock.Now())
+	})
+
+	t.Run("After with custom AfterFunc", func(t *testing.T) {
+		customTime := time.Date(2025, 6, 15, 0, 0, 0, 0, time.UTC)
+		clock := &MockClock{
+			CurrentTime: time.Now(),
+			AfterFunc: func(d time.Duration) <-chan time.Time {
+				ch := make(chan time.Time, 1)
+				ch <- customTime
+				return ch
+			},
+		}
+
+		ch := clock.After(time.Second)
+		select {
+		case receivedTime := <-ch:
+			assert.Equal(t, customTime, receivedTime)
+		default:
+			assert.Fail(t, "After should return immediately")
+		}
+	})
+}
+
+// Test nil clock fallback paths
+func TestClient_NilClockFallback(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("WaitForServices with nil clock uses real clock", func(t *testing.T) {
+		// This test verifies the nil clock fallback path
+		// We use a very short timeout and a mock that returns healthy immediately
+		mockTalos := &MockTalosMachineClient{
+			ServiceInfoFunc: func(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+				return []talosclient.ServiceInfo{
+					{
+						Service: &machine.ServiceInfo{
+							Id:     service,
+							State:  "Running",
+							Health: &machine.ServiceHealth{Healthy: true},
+						},
+					},
+				}, nil
+			},
+		}
+		// Note: clock is nil here - exercises the fallback
+		c := &Client{talos: mockTalos, clock: nil}
+		err := c.WaitForServices(ctx, "192.168.1.1", []string{"etcd"}, time.Second)
+		require.NoError(t, err)
+	})
+
+	t.Run("WaitForNode with nil clock uses real clock", func(t *testing.T) {
+		mockTalos := &MockTalosMachineClient{
+			VersionFunc: func(ctx context.Context) (*machine.VersionResponse, error) {
+				return &machine.VersionResponse{
+					Messages: []*machine.Version{
+						{Version: &machine.VersionInfo{Tag: "v1.7.0"}},
+					},
+				}, nil
+			},
+		}
+		// Note: clock is nil here - exercises the fallback
+		c := &Client{talos: mockTalos, k8s: nil, clock: nil}
+		err := c.WaitForNode(ctx, "192.168.1.1", time.Second)
+		require.NoError(t, err)
+	})
+}

internal/talos/clock.go

···
+package talos
+
+import "time"
+
+// Clock abstracts time operations for testing.
+// This allows deterministic testing of timeout and polling logic.
+type Clock interface {
+	// Now returns the current time
+	Now() time.Time
+
+	// After waits for the duration to elapse and returns a channel
+	After(d time.Duration) <-chan time.Time
+
+	// Sleep pauses the current goroutine for the duration
+	Sleep(d time.Duration)
+}
+
+// realClock implements Clock using the real time package
+type realClock struct{}
+
+// newRealClock creates a new real clock instance
+func newRealClock() Clock {
+	return realClock{}
+}
+
+func (realClock) Now() time.Time {
+	return time.Now()
+}
+
+func (realClock) After(d time.Duration) <-chan time.Time {
+	return time.After(d)
+}
+
+func (realClock) Sleep(d time.Duration) {
+	time.Sleep(d)
+}
+
+// MockClock is a mock implementation of Clock for testing
+type MockClock struct {
+	// CurrentTime is the time returned by Now()
+	CurrentTime time.Time
+
+	// AfterFunc is called when After is invoked
+	// If nil, returns a channel that receives immediately
+	AfterFunc func(d time.Duration) <-chan time.Time
+
+	// SleepFunc is called when Sleep is invoked
+	// If nil, does nothing (returns immediately)
+	SleepFunc func(d time.Duration)
+
+	// AdvanceOnAfter if true, advances CurrentTime by the duration on After calls
+	AdvanceOnAfter bool
+}
+
+// NewMockClock creates a mock clock with the given start time
+func NewMockClock(startTime time.Time) *MockClock {
+	return &MockClock{CurrentTime: startTime}
+}
+
+func (m *MockClock) Now() time.Time {
+	return m.CurrentTime
+}
+
+func (m *MockClock) After(d time.Duration) <-chan time.Time {
+	if m.AfterFunc != nil {
+		return m.AfterFunc(d)
+	}
+	if m.AdvanceOnAfter {
+		m.CurrentTime = m.CurrentTime.Add(d)
+	}
+	// Return immediately for testing
+	ch := make(chan time.Time, 1)
+	ch <- m.CurrentTime
+	return ch
+}
+
+func (m *MockClock) Sleep(d time.Duration) {
+	if m.SleepFunc != nil {
+		m.SleepFunc(d)
+		return
+	}
+	// Advance time but don't actually sleep
+	m.CurrentTime = m.CurrentTime.Add(d)
+}
+
+// Advance moves the clock forward by the specified duration
+func (m *MockClock) Advance(d time.Duration) {
+	m.CurrentTime = m.CurrentTime.Add(d)
+}
+
+// Ensure realClock implements Clock
+var _ Clock = realClock{}
+
+// Ensure MockClock implements Clock
+var _ Clock = (*MockClock)(nil)

internal/talos/interfaces.go

···
+package talos
+
+import (
+	"context"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	talosclient "github.com/siderolabs/talos/pkg/machinery/client"
+)
+
+// ExtensionInfo represents information about an installed extension
+type ExtensionInfo struct {
+	Name    string // Extension name (e.g., "gasket-driver")
+	Version string // Extension version
+	Image   string // Full image reference
+}
+
+// ClusterMember represents a discovered cluster member
+type ClusterMember struct {
+	IP          string // Primary IP address
+	Hostname    string // Node hostname
+	Role        string // "controlplane" or "worker"
+	MachineType string // Raw machine type from Talos
+}
+
+// HardwareInfo represents hardware information for profile detection
+type HardwareInfo struct {
+	SystemManufacturer    string // e.g., "raspberrypi", "turing", "Framework"
+	SystemProductName     string // e.g., "Raspberry Pi Compute Module 4"
+	ProcessorManufacturer string // e.g., "Intel(R) Corporation", "Advanced Micro Devices"
+	ProcessorProductName  string // e.g., "Intel(R) Core(TM) i9-10850K"
+}
+
+// TalosClientInterface defines the interface for interacting with Talos nodes.
+// This interface enables mocking the Talos client for testing.
+type TalosClientInterface interface {
+	// Close closes the client connection
+	Close() error
+
+	// GetVersion retrieves the Talos version for a node
+	GetVersion(ctx context.Context, nodeIP string) (string, error)
+
+	// GetMachineType retrieves the machine type for a node
+	GetMachineType(ctx context.Context, nodeIP string) (string, error)
+
+	// GetExtensions retrieves the list of installed extensions for a node
+	GetExtensions(ctx context.Context, nodeIP string) ([]ExtensionInfo, error)
+
+	// IsReachable checks if a node is reachable via the Talos API
+	IsReachable(ctx context.Context, nodeIP string) bool
+
+	// Upgrade performs an upgrade on a node
+	Upgrade(ctx context.Context, nodeIP, image string, preserve bool) error
+
+	// WaitForNode waits for a node to be ready after upgrade
+	WaitForNode(ctx context.Context, nodeIP string, timeout time.Duration) error
+
+	// GetNodeStatus retrieves comprehensive status for a node
+	GetNodeStatus(ctx context.Context, nodeIP, profile, role string, secureboot bool) NodeStatus
+
+	// WatchUpgrade streams upgrade events
+	WatchUpgrade(ctx context.Context, nodeIP string, timeout time.Duration, onProgress ProgressCallback) error
+
+	// WaitForServices waits for critical Talos services to be healthy
+	WaitForServices(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error
+
+	// WaitForStaticPods waits for K8s control plane static pods to be healthy
+	WaitForStaticPods(ctx context.Context, nodeIP string, timeout time.Duration) error
+
+	// GetClusterMembers discovers all nodes in the cluster
+	GetClusterMembers(ctx context.Context) ([]ClusterMember, error)
+
+	// GetHardwareInfo retrieves hardware information for profile detection
+	GetHardwareInfo(ctx context.Context, nodeIP string) (*HardwareInfo, error)
+
+	// GetKernelCmdline retrieves the kernel command line from a node
+	GetKernelCmdline(ctx context.Context, nodeIP string) (string, error)
+}
+
+// Ensure Client implements TalosClientInterface
+var _ TalosClientInterface = (*Client)(nil)
+
+// MockClient is a mock implementation of TalosClientInterface for testing
+type MockClient struct {
+	// GetVersionFunc is the mock implementation of GetVersion
+	GetVersionFunc func(ctx context.Context, nodeIP string) (string, error)
+
+	// GetMachineTypeFunc is the mock implementation of GetMachineType
+	GetMachineTypeFunc func(ctx context.Context, nodeIP string) (string, error)
+
+	// GetExtensionsFunc is the mock implementation of GetExtensions
+	GetExtensionsFunc func(ctx context.Context, nodeIP string) ([]ExtensionInfo, error)
+
+	// IsReachableFunc is the mock implementation of IsReachable
+	IsReachableFunc func(ctx context.Context, nodeIP string) bool
+
+	// UpgradeFunc is the mock implementation of Upgrade
+	UpgradeFunc func(ctx context.Context, nodeIP, image string, preserve bool) error
+
+	// WaitForNodeFunc is the mock implementation of WaitForNode
+	WaitForNodeFunc func(ctx context.Context, nodeIP string, timeout time.Duration) error
+
+	// GetNodeStatusFunc is the mock implementation of GetNodeStatus
+	GetNodeStatusFunc func(ctx context.Context, nodeIP, profile, role string, secureboot bool) NodeStatus
+
+	// WatchUpgradeFunc is the mock implementation of WatchUpgrade
+	WatchUpgradeFunc func(ctx context.Context, nodeIP string, timeout time.Duration, onProgress ProgressCallback) error
+
+	// WaitForServicesFunc is the mock implementation of WaitForServices
+	WaitForServicesFunc func(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error
+
+	// WaitForStaticPodsFunc is the mock implementation of WaitForStaticPods
+	WaitForStaticPodsFunc func(ctx context.Context, nodeIP string, timeout time.Duration) error
+
+	// GetClusterMembersFunc is the mock implementation of GetClusterMembers
+	GetClusterMembersFunc func(ctx context.Context) ([]ClusterMember, error)
+
+	// GetHardwareInfoFunc is the mock implementation of GetHardwareInfo
+	GetHardwareInfoFunc func(ctx context.Context, nodeIP string) (*HardwareInfo, error)
+
+	// GetKernelCmdlineFunc is the mock implementation of GetKernelCmdline
+	GetKernelCmdlineFunc func(ctx context.Context, nodeIP string) (string, error)
+}
+
+func (m *MockClient) Close() error {
+	return nil
+}
+
+func (m *MockClient) GetVersion(ctx context.Context, nodeIP string) (string, error) {
+	if m.GetVersionFunc != nil {
+		return m.GetVersionFunc(ctx, nodeIP)
+	}
+	return "1.7.0", nil
+}
+
+func (m *MockClient) GetMachineType(ctx context.Context, nodeIP string) (string, error) {
+	if m.GetMachineTypeFunc != nil {
+		return m.GetMachineTypeFunc(ctx, nodeIP)
+	}
+	return "unknown", nil
+}
+
+func (m *MockClient) GetExtensions(ctx context.Context, nodeIP string) ([]ExtensionInfo, error) {
+	if m.GetExtensionsFunc != nil {
+		return m.GetExtensionsFunc(ctx, nodeIP)
+	}
+	return []ExtensionInfo{}, nil
+}
+
+func (m *MockClient) IsReachable(ctx context.Context, nodeIP string) bool {
+	if m.IsReachableFunc != nil {
+		return m.IsReachableFunc(ctx, nodeIP)
+	}
+	return true
+}
+
+func (m *MockClient) Upgrade(ctx context.Context, nodeIP, image string, preserve bool) error {
+	if m.UpgradeFunc != nil {
+		return m.UpgradeFunc(ctx, nodeIP, image, preserve)
+	}
+	return nil
+}
+
+func (m *MockClient) WaitForNode(ctx context.Context, nodeIP string, timeout time.Duration) error {
+	if m.WaitForNodeFunc != nil {
+		return m.WaitForNodeFunc(ctx, nodeIP, timeout)
+	}
+	return nil
+}
+
+func (m *MockClient) GetNodeStatus(ctx context.Context, nodeIP, profile, role string, secureboot bool) NodeStatus {
+	if m.GetNodeStatusFunc != nil {
+		return m.GetNodeStatusFunc(ctx, nodeIP, profile, role, secureboot)
+	}
+	return NodeStatus{
+		IP:          nodeIP,
+		Profile:     profile,
+		Role:        role,
+		Version:     "1.7.0",
+		MachineType: "unknown",
+		Secureboot:  secureboot,
+		Reachable:   true,
+	}
+}
+
+func (m *MockClient) WatchUpgrade(ctx context.Context, nodeIP string, timeout time.Duration, onProgress ProgressCallback) error {
+	if m.WatchUpgradeFunc != nil {
+		return m.WatchUpgradeFunc(ctx, nodeIP, timeout, onProgress)
+	}
+	return nil
+}
+
+func (m *MockClient) WaitForServices(ctx context.Context, nodeIP string, services []string, timeout time.Duration) error {
+	if m.WaitForServicesFunc != nil {
+		return m.WaitForServicesFunc(ctx, nodeIP, services, timeout)
+	}
+	return nil
+}
+
+func (m *MockClient) WaitForStaticPods(ctx context.Context, nodeIP string, timeout time.Duration) error {
+	if m.WaitForStaticPodsFunc != nil {
+		return m.WaitForStaticPodsFunc(ctx, nodeIP, timeout)
+	}
+	return nil
+}
+
+func (m *MockClient) GetClusterMembers(ctx context.Context) ([]ClusterMember, error) {
+	if m.GetClusterMembersFunc != nil {
+		return m.GetClusterMembersFunc(ctx)
+	}
+	return []ClusterMember{}, nil
+}
+
+func (m *MockClient) GetHardwareInfo(ctx context.Context, nodeIP string) (*HardwareInfo, error) {
+	if m.GetHardwareInfoFunc != nil {
+		return m.GetHardwareInfoFunc(ctx, nodeIP)
+	}
+	return &HardwareInfo{}, nil
+}
+
+func (m *MockClient) GetKernelCmdline(ctx context.Context, nodeIP string) (string, error) {
+	if m.GetKernelCmdlineFunc != nil {
+		return m.GetKernelCmdlineFunc(ctx, nodeIP)
+	}
+	return "", nil
+}
+
+// MockTalosMachineClient is a mock implementation of TalosMachineClient for testing
+// SDK-dependent functions in the Client struct.
+type MockTalosMachineClient struct {
+	// CloseFunc is the mock implementation of Close
+	CloseFunc func() error
+
+	// VersionFunc is the mock implementation of Version
+	VersionFunc func(ctx context.Context) (*machine.VersionResponse, error)
+
+	// UpgradeWithOptionsFunc is the mock implementation of UpgradeWithOptions
+	UpgradeWithOptionsFunc func(ctx context.Context, opts ...talosclient.UpgradeOption) (*machine.UpgradeResponse, error)
+
+	// ServiceInfoFunc is the mock implementation of ServiceInfo
+	ServiceInfoFunc func(ctx context.Context, service string) ([]talosclient.ServiceInfo, error)
+
+	// EventsWatchV2Func is the mock implementation of EventsWatchV2
+	EventsWatchV2Func func(ctx context.Context, eventCh chan<- talosclient.EventResult, opts ...talosclient.EventsOptionFunc) error
+
+	// COSIListFunc is the mock implementation of COSIList
+	COSIListFunc func(ctx context.Context, md resource.Metadata) (resource.List, error)
+}
+
+// Ensure MockTalosMachineClient implements TalosMachineClient
+var _ TalosMachineClient = (*MockTalosMachineClient)(nil)
+
+func (m *MockTalosMachineClient) Close() error {
+	if m.CloseFunc != nil {
+		return m.CloseFunc()
+	}
+	return nil
+}
+
+func (m *MockTalosMachineClient) Version(ctx context.Context) (*machine.VersionResponse, error) {
+	if m.VersionFunc != nil {
+		return m.VersionFunc(ctx)
+	}
+	return &machine.VersionResponse{
+		Messages: []*machine.Version{
+			{
+				Version: &machine.VersionInfo{Tag: "v1.7.0"},
+			},
+		},
+	}, nil
+}
+
+func (m *MockTalosMachineClient) UpgradeWithOptions(ctx context.Context, opts ...talosclient.UpgradeOption) (*machine.UpgradeResponse, error) {
+	if m.UpgradeWithOptionsFunc != nil {
+		return m.UpgradeWithOptionsFunc(ctx, opts...)
+	}
+	return &machine.UpgradeResponse{}, nil
+}
+
+func (m *MockTalosMachineClient) ServiceInfo(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+	if m.ServiceInfoFunc != nil {
+		return m.ServiceInfoFunc(ctx, service)
+	}
+	return []talosclient.ServiceInfo{}, nil
+}
+
+func (m *MockTalosMachineClient) EventsWatchV2(ctx context.Context, eventCh chan<- talosclient.EventResult, opts ...talosclient.EventsOptionFunc) error {
+	if m.EventsWatchV2Func != nil {
+		return m.EventsWatchV2Func(ctx, eventCh, opts...)
+	}
+	return nil
+}
+
+func (m *MockTalosMachineClient) COSIList(ctx context.Context, md resource.Metadata) (resource.List, error) {
+	if m.COSIListFunc != nil {
+		return m.COSIListFunc(ctx, md)
+	}
+	return resource.List{}, nil
+}

internal/talos/talos_client.go

···
+package talos
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	talosclient "github.com/siderolabs/talos/pkg/machinery/client"
+)
+
+// TalosMachineClient abstracts Talos SDK operations for testing.
+// This interface allows mocking the Talos SDK client in unit tests.
+type TalosMachineClient interface {
+	// Close closes the client connection
+	Close() error
+
+	// Version retrieves the Talos version
+	Version(ctx context.Context) (*machine.VersionResponse, error)
+
+	// UpgradeWithOptions performs an upgrade with the given options
+	UpgradeWithOptions(ctx context.Context, opts ...talosclient.UpgradeOption) (*machine.UpgradeResponse, error)
+
+	// ServiceInfo retrieves information about a specific service
+	ServiceInfo(ctx context.Context, service string) ([]talosclient.ServiceInfo, error)
+
+	// EventsWatchV2 watches for machine events
+	EventsWatchV2(ctx context.Context, eventCh chan<- talosclient.EventResult, opts ...talosclient.EventsOptionFunc) error
+
+	// COSIList lists COSI resources
+	COSIList(ctx context.Context, md resource.Metadata) (resource.List, error)
+}
+
+// talosClientWrapper wraps the real SDK client to implement TalosMachineClient
+type talosClientWrapper struct {
+	client *talosclient.Client
+}
+
+// newTalosClientWrapper creates a wrapper around the SDK client
+func newTalosClientWrapper(client *talosclient.Client) *talosClientWrapper {
+	return &talosClientWrapper{client: client}
+}
+
+func (w *talosClientWrapper) Close() error {
+	return w.client.Close()
+}
+
+func (w *talosClientWrapper) Version(ctx context.Context) (*machine.VersionResponse, error) {
+	return w.client.Version(ctx)
+}
+
+func (w *talosClientWrapper) UpgradeWithOptions(ctx context.Context, opts ...talosclient.UpgradeOption) (*machine.UpgradeResponse, error) {
+	return w.client.UpgradeWithOptions(ctx, opts...)
+}
+
+func (w *talosClientWrapper) ServiceInfo(ctx context.Context, service string) ([]talosclient.ServiceInfo, error) {
+	return w.client.ServiceInfo(ctx, service)
+}
+
+func (w *talosClientWrapper) EventsWatchV2(ctx context.Context, eventCh chan<- talosclient.EventResult, opts ...talosclient.EventsOptionFunc) error {
+	return w.client.EventsWatchV2(ctx, eventCh, opts...)
+}
+
+func (w *talosClientWrapper) COSIList(ctx context.Context, md resource.Metadata) (resource.List, error) {
+	return w.client.COSI.List(ctx, md)
+}
+
+// Ensure talosClientWrapper implements TalosMachineClient
+var _ TalosMachineClient = (*talosClientWrapper)(nil)
+
+// COSIState wraps the COSI state client for advanced operations
+type COSIState interface {
+	state.CoreState
+}