Sidero Omni for swamp, through omnictl. Two model types, two roles.
@dataverket/omnictl/inventory reads: discover writes one node per managed machine (hardware, network, Talos version, cluster role, connection and readiness), one cluster per cluster and a summary; talosconfig mints one cluster's admin talosconfig for the service account and stores it with the cluster's node IPs, which is everything @dataverket/talosctl/node needs to reach the machines through Omni's proxy; joinTokens lists the join tokens by fingerprint, state and use. A Reader service account.
@dataverket/omnictl/cluster writes: applyPatch creates or updates a ConfigPatch, from text or a file in the repository, scoped to a machine, a machine set or a cluster; addMachine puts a machine into a machine set by its MachineSetNode, with the set's role label, without which Omni never allocates it; removeMachine is omnictl cluster machine delete, which drains, wipes and waits; deleteMachine is the dashboard's Delete Machine: the machine's own config patches and its Link, after which Omni tears down the Machine, also when a removal hangs because the server is gone; setExtensions sets the system extensions for a machine, a machine set or a cluster. Every apply takes dryRun. An Operator service account, on its own model instance with its own vault key.
Forked from @mccormick/omni (MIT) as @dataverket/omni; renamed after the CLI it wraps. The key is named as a file read at call time (serviceAccountKeyFile) or given as a value from a vault (serviceAccountKey), never both; either way it is marked sensitive and redacted from logs and errors. Both models check before every method that the key resolves and that Omni accepts it, so an expired key stops a run with a message that says so.