What is this IP address?

This is the Kubernetes cluster Member Discovery Service run by Sidero Labs.

If you see traffic to this IP address, it is from Kubernetes nodes in your organization that are using KubeSpan to coordinate secure, encrypted membership of a Kubernetes cluster. This service provides back information needed to establish the secure communication channels.

All information to and from this service is encrypted, and the service cannot decrypt the data - only the nodes that are part of the same Kubernetes cluster can decrypt it.

For more information, see https://www.siderolabs.com/platform/kubespan/.

Details

Before sending data to the discovery service, Talos will encrypt the affiliate data with AES-GCM encryption and separately encrypt endpoints with AES in ECB mode so that endpoints coming from different sources can be deduplicated server-side.

Each node submits its data encrypted plus it submits the endpoints it sees from other peers to the discovery service. The discovery service aggregates the data, deduplicates the endpoints, and sends updates to each connected peer. Each peer receives information back about other affiliates from the discovery service, decrypts it and uses it to drive KubeSpan and cluster discovery.

Data is stored in memory only with a TTL set by the clients (i.e., Talos), and periodic snapshots to disk are enabled. The cluster ID is used as a key to select the affiliates (so that different clusters see different affiliates).

To summarize, the discovery service knows the client version, cluster ID, the number of affiliates, some encrypted data for each affiliate, and a list of encrypted endpoints.

You can get data stored in the discovery service for the cluster ID on inspect page.