Releases: nberlee/talos
v1.6.4
Talos 1.6.4 (2024-02-01)
Welcome to the v1.6.4 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Installer Turingrk1 image
When upgrading using talosctl upgrade -i
a -rk3588
can be added to the install image tag to get the image
with the rk3588 extension. This eliminates the need for defining the extension in the machine config.
Please remove the extension from the machine config before using
talosctl upgrade -i ghcr.io/nberlee/installer:v1.6.4-rk3588
Component Updates
containerd: 1.7.13
runc: 1.1.12
Linux: 6.6.15
See CVE-2024-21626 for the runc update.
Talos is built with Go 1.21.6.
Contributors
- Andrey Smirnov
- Andrey Smirnov
- Dmitriy Matrenichev
- Utku Ozdemir
- Nico Berlee
- Noel Georgi
- Artem Chernyshev
Changes
9 commits
- siderolabs/talos@745e347d9 feat: adds board Turing RK1
- siderolabs/talos@422b26d05 github ci
- siderolabs/talos@431bcada7 release(v1.6.4): prepare release
- siderolabs/talos@040c535c6 fix: retry blockdevice open in the installer
- siderolabs/talos@00b34b254 fix: take into account the moment seen when cleaning up CRI images
- siderolabs/talos@c5ad166be fix: be more tolerant to error handling in Mounts API
- siderolabs/talos@b438f8a9b fix: run the interactive installer loop to report errors
- siderolabs/talos@12e83b7e3 docs: clarify node taints/labels for worker nodes
- siderolabs/talos@7840f8a89 feat: update containerd 1.7.13, runc 1.1.12
Changes from siderolabs/go-api-signature
20 commits
- siderolabs/go-api-signature@370cebf fix: always print the login URL on key renew flow
- siderolabs/go-api-signature@d28609a feat: move in the cli grpc interceptor logic, support service account in env
- siderolabs/go-api-signature@4602acc chore: add a dummy workflow
- siderolabs/go-api-signature@cfd21b6 fix: support validating signatures generated with the time in the future
- siderolabs/go-api-signature@74dd3dc chore: bump deps
- siderolabs/go-api-signature@d78bedb chore: bump deps
- siderolabs/go-api-signature@a034e9f feat: replace scopes with roles
- siderolabs/go-api-signature@5b4f3bb chore: run rekres
- siderolabs/go-api-signature@9dba116 chore: remove time.Sleep hack
- siderolabs/go-api-signature@e84e686 chore: bump dependencies
- siderolabs/go-api-signature@8baaf8a chore: bump deps
- siderolabs/go-api-signature@5f27e1e chore: add renovate bot and bump deps
- siderolabs/go-api-signature@69886dc feat: allow custom validations on PGP key
- siderolabs/go-api-signature@63d4da3 fix: limit clock skew for short-lived keys
- siderolabs/go-api-signature@cdb9722 feat: add support for +-5 min clock skew
- siderolabs/go-api-signature@7b80a50 refactor: use options pattern in RegisterPGPPublicKey
- siderolabs/go-api-signature@c647861 feat: add scopes to RegisterPublicKeyRequest
- siderolabs/go-api-signature@5d3647e feat: provide more client PGP functions
- siderolabs/go-api-signature@2b682ec feat: initial version
- siderolabs/go-api-signature@a4c2943 chore: initial commit
Changes from siderolabs/pkgs
Dependency Changes
- github.com/containerd/containerd v1.7.11 -> v1.7.13
- github.com/opencontainers/runtime-spec v1.1.0-rc.1 -> v1.1.0
- github.com/siderolabs/go-api-signature v0.3.1 new
- github.com/siderolabs/pkgs v1.6.0-15-gf51aedb -> v1.6.0-16-gb77ffb7
- github.com/siderolabs/talos/pkg/machinery v1.6.3 -> v1.6.4
Previous release can be found at v1.6.3
v1.6.3
Talos 1.6.3 (2024-01-24)
Welcome to the v1.6.3 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.6.13
Kubernetes: 1.29.1
Talos is built with Go 1.21.6.
Contributors
- Andrey Smirnov
- Nico Berlee
Changes
6 commits
- siderolabs/talos@7a087ccb2 feat: adds board Turing RK1
- siderolabs/talos@eac9c6643 github ci
- siderolabs/talos@d53e07c1a release(v1.6.3): prepare release
- siderolabs/talos@815fef8c3 fix: allow META encoded values to be compressed
- siderolabs/talos@56e87f55b feat: update Kubernetes default to 1.29.1
- siderolabs/talos@63fc46f0a feat: update Linux to 6.1.74
Changes from siderolabs/pkgs
3 commits
- siderolabs/pkgs@f51aedb fix: disable nct6883 on arm64
- siderolabs/pkgs@7ddbdb4 fix: enable FUSION_SPI driver
- siderolabs/pkgs@00d2978 feat: update Linux to 6.1.74
Dependency Changes
- github.com/siderolabs/pkgs v1.6.0-12-g0078a66 -> v1.6.0-15-gf51aedb
- github.com/siderolabs/talos/pkg/machinery v1.6.2 -> v1.6.3
- k8s.io/api v0.29.0 -> v0.29.1
- k8s.io/apimachinery v0.29.0 -> v0.29.1
- k8s.io/apiserver v0.29.0 -> v0.29.1
- k8s.io/client-go v0.29.0 -> v0.29.1
- k8s.io/component-base v0.29.0 -> v0.29.1
- k8s.io/cri-api v0.29.0 -> v0.29.1
- k8s.io/kube-scheduler v0.29.0 -> v0.29.1
- k8s.io/kubectl v0.29.0 -> v0.29.1
- k8s.io/kubelet v0.29.0 -> v0.29.1
Previous release can be found at v1.6.2
v1.6.2
Talos 1.6.2 (2024-01-18)
Welcome to the v1.6.2 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.6.12
containerd: 1.7.11
u-boot: 2024-01
Talos is built with Go 1.21.6.
Contributors
- Andrey Smirnov
- Utku Ozdemir
- Nico Berlee
- Dmitriy Matrenichev
- Drew Hess
- Hervé Werner
- JJGadgets
- Jonomir
- Sebastian Gaiser
- Serge Logvinov
Changes
19 commits
- siderolabs/talos@25a7cd9b2 feat: adds board Turing RK1
- siderolabs/talos@2292acb8a github ci
- siderolabs/talos@5821a6112 docs: extend hetzner-cloud docs for arm64
- siderolabs/talos@26eee7553 release(v1.6.2): prepare release
- siderolabs/talos@f87a0468b fix: strategic patch merging for audit policy
- siderolabs/talos@36b913dba fix: watch bufer overrun for RouteStatus
- siderolabs/talos@3576d113c fix: fix .der output in
talosctl gen secureboot
- siderolabs/talos@0191c3b2c fix: support KubePrism settings in Kubernetes Discovery
- siderolabs/talos@8fa6e93f0 fix: force KubePrism to connect using IPv4
- siderolabs/talos@e05eebca1 fix: update kmsg with utf-8 fix
- siderolabs/talos@37bfa60dd fix: merge ports and ingress configs correctly in NetworkRuleConfig
- siderolabs/talos@306c5cad2 fix: fix nodes on dashboard footer when node names are used in
--nodes
- siderolabs/talos@530332d24 fix: disk UUID & WWID always empty in
talosctl disks
- siderolabs/talos@440f56341 chore: pull in NBD modules
- siderolabs/talos@3ebdbabaf fix: default priority for ipv6
- siderolabs/talos@b47619543 fix: replace the filemap implementation to not buffer in memory
- siderolabs/talos@0ec551597 fix: imager should support different Talos versions
- siderolabs/talos@4b3168624 feat: support iPXE direct booting in
talosctl cluster create
- siderolabs/talos@d98699c07 feat: update Linux 6.1.73, go 1.21.6
Changes from siderolabs/go-kmsg
2 commits
- siderolabs/go-kmsg@e358d13 fix: decode escape sequences while reading from kmsg
- siderolabs/go-kmsg@4297bd5 feat: add BSD support
Changes from siderolabs/pkgs
3 commits
- siderolabs/pkgs@0078a66 feat: enable NBD
- siderolabs/pkgs@31b9d61 feat: enable nct6683 sensors as module
- siderolabs/pkgs@f8c6a35 feat: go 1.21.6, linux 6.1.73
Changes from siderolabs/tools
Dependency Changes
- github.com/pin/tftp 2f79be2dba4e new
- github.com/siderolabs/go-kmsg v0.1.3 -> v0.1.4
- github.com/siderolabs/pkgs v1.6.0-9-g8fa73db -> v1.6.0-12-g0078a66
- github.com/siderolabs/talos/pkg/machinery v1.6.1 -> v1.6.2
- github.com/siderolabs/tools v1.6.0-1-g336d248 -> v1.6.0-2-g5e034ec
- golang.org/x/sys v0.15.0 -> v0.16.0
Previous release can be found at v1.6.1
v1.6.1
Talos 1.6.1 (2023-12-22)
Welcome to the v1.6.1 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.6.8
containerd: 1.7.11
u-boot: 2024-01-rc5
Talos is built with Go 1.21.5.
Contributors
- Andrey Smirnov
- Nico Berlee
- Radosław Piliszek
- Sebastian Gaiser
Changes
8 commits
- siderolabs/talos@796c67e68 feat: adds board Turing RK1
- siderolabs/talos@b333d2069 github ci
- siderolabs/talos@907f78871 docs: extend hetzner-cloud docs for arm64
- siderolabs/talos@0af17af3a release(v1.6.1): prepare release
- siderolabs/talos@8355c9eef fix: properly overwrite files on install
- siderolabs/talos@2e9901751 fix: update the way secureboot signer fetches certificate (azure)
- siderolabs/talos@4caffd383 fix: use correct prefix when installing SBC files
- siderolabs/talos@9e56d539b feat: update Linux to 6.1.69, containerd to 1.7.11
Changes from siderolabs/pkgs
4 commits
- siderolabs/pkgs@8fa73db feat: update Linux to 6.1.69
- siderolabs/pkgs@f36484e feat: update containerd to 1.7.11
- siderolabs/pkgs@6fdc79a feat: enable IRQ remapping on amd64
- siderolabs/pkgs@22cd9b4 chore: disable one commit check
Dependency Changes
- github.com/containerd/containerd v1.7.9 -> v1.7.11
- github.com/siderolabs/pkgs v1.6.0-5-g3ae2450 -> v1.6.0-9-g8fa73db
- github.com/siderolabs/talos/pkg/machinery v1.6.0 -> v1.6.1
Previous release can be found at v1.6.0
v1.6.0
Talos 1.6.0 (2023-12-18)
Welcome to the v1.6.0 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
OAuth2 Machine Config Flow
Talos Linux when running on the metal
platform can be configured to authenticate the machine configuration download using OAuth2 device flow.
Turing RK1 support
This fork has Turing RK1 board support. Everything should work except for HDMI and UART2 serial console.
Make sure to add the extension ghcr.io/nberlee/rk3588:v1.6.x
to the machine config and add rockchip-cpufreq
to machine.kernel.module:
machine:
kernel:
modules:
- name: rockchip-cpufreq
also add for the rk3588
extension the next upgrade:
machine:
install:
extensions:
- image: ghcr.io/nberlee/rk3588:v1.6.x
Network Device Selectors
Previously, network device selectors only matched the first link, now the configuration is applied to all matching links.
Extension Services
Talos now starts Extension Services early in the boot process, this allows guest agents to be started in maintenance mode.
Linux Firmware
Starting with Talos 1.6, there is no Linux firmware included in the initramfs.
Customers who need Linux firmware can pull them as extension during install time using the image factory service.
If the initial boot requires firmware, a custom iso can be built with the firmware included using the image factory service.
This also ensures that the linux-firmware is not tied to a specific Talos version.
Flannel Configuration
Talos Linux now supports customizing default Flannel manifest with extra arguments for flanneld.
cluster:
network:
cni:
flannel:
extraArgs:
- --iface-can-reach=192.168.1.1
Ingress Firewall
Talos Linux now supports configuring the ingress firewall rules.
New LTS Kernel
This fork comes with a new LTS Kernel v6.6.
It was needed to upgrade it because of the support for the RK3588. It also has some upstream patches from 6.7-rc.
Kernel Arguments
Talos and Imager now supports dropping kernel arguments specified in .machine.install.extraKernelArgs
or as --extra-kernel-arg
to imager.
Any kernel argument that starts with a -
is dropped. Kernel arguments to be dropped can be specified either as -<key>
which would remove all arguments that start with <key>
or as -<key>=<value>
which would remove the exact argument.
Kube-Scheduler Configuration
Talos now supports specifying the kube-scheduler configuration in the Talos configuration file.
It can be set under cluster.scheduler.config
and kube-scheduler will be automatically configured to with the correct flags.
Kubelet Credential Provider Configuration
Talos now supports specifying the kubelet credential provider configuration in the Talos configuration file.
It can be set under machine.kubelet.credentialProviderConfig
and kubelet will be automatically configured to with the correct flags.
The credential binaries are expected to be present under /usr/local/lib/kubelet/credentialproviders
.
Talos System Extensions can be used to install the credential binaries.
KubePrism
KubePrism is enabled by default on port 7445.
Sysctl
Talos now handles sysctl/sysfs key names in line with sysctl.conf(5):
- if the first separator is '/', no conversion is done
- if the first separator is '.', dots and slashes are remapped
Example (both sysctls are equivalent):
machine:
sysctls:
net/ipv6/conf/eth0.100/disable_ipv6: "1"
net.ipv6.conf.eth0/100.disable_ipv6: "1"
talosctl CLI
The command images
deprecated in Talos 1.5 was removed, please use talosctl images default
instead.
Component Updates
Linux: 6.6.7
containerd: 1.7.10
CoreDNS: 1.11.1
Kubernetes: 1.29.0
Flannel: 0.23.0
etcd: 3.5.11
runc: 1.1.10
u-boot: 2024.01-rc4
arm-trusted-firmware: 2.10.0
Talos is built with Go 1.21.5.
User Disks
Talos Linux now supports specifying user disks in .machine.disks
machine configuration links via udev
symlinks, e.g. /dev/disk/by-id/XXXX
.
Contributors
- Andrey Smirnov
- Noel Georgi
- Dmitriy Matrenichev
- Oscar Utbult
- Serge Logvinov
- Andrey Smirnov
- Artem Chernyshev
- Nico Berlee
- Utku Ozdemir
- Radosław Piliszek
- Steve Francis
- Thomas Way
- ndbrew
- Andrei Kvapil
- Christian Rolland
- Drew Hess
- Enno Boland
- Florian Berchtold
- Henry Sachs
- Jacob McSwain
- Jacob McSwain
- Jared Davenport
- Mans Matulewicz
- Nebula
- Sascha Desch
- Sebastian Gaiser
- Spencer Smith
- Thomas Lemarchand
- Tim Jones
- Zachary Milonas
- budimanjojo
- guoguangwu
- mikucat0309
Changes
221 commits
- siderolabs/talos@9d86c7f65 feat: adds board Turing RK1
- siderolabs/talos@a2ac05c83 github ci
- siderolabs/talos@eeafb0e7b docs: extend hetzner-cloud docs for arm64
- siderolabs/talos@eddd188c9 release(v1.6.0): prepare release
- siderolabs/talos@d42fd10c0 chore: fix the gvisor test
- siderolabs/talos@333c462c5 feat: update Kubernetes to v1.29.0
- siderolabs/talos@61e6df169 fix: leave discovery service later in the reset sequence
- siderolabs/talos@ef15a1f23 feat: provide compatibility for future Talos 1.7
- siderolabs/talos@c155602ca fix: add a KubeSpan option to disable extra endpoint harvesting
- siderolabs/talos@5371eedd6 feat: send
actor id
to the SideroLink events sink - siderolabs/talos@997f83f1f docs: cap max heading level
- siderolabs/talos@d9db4cf76 feat: update Kubernetes to v1.29.0-rc.2
- siderolabs/talos@d510df5df chore: enable kubespan+firewall for cilium tests
- siderolabs/talos@b61b30056 chore: optimize pcap dump
- siderolabs/talos@007d9f673 feat: update Linux to 6.1.67
- siderolabs/talos@7b7fb367e release(v1.6.0-beta.1): prepare release
- siderolabs/talos@fe6661128 fix: talosctl cluster create not to enforce kubeprism always
- siderolabs/talos@41fc05438 fix: support user disks via symlinks
- siderolabs/talos@1fe7f2840 docs: rework machine config documentation generation
- siderolabs/talos@e45794064 chore: fix the release.toml
- siderolabs/talos@591cfb456 fix: store and execute desired action on emergency action
- siderolabs/talos@fee63ac26 fix: trim leading spaces\newlines in inline manifest contents
- siderolabs/talos@cc16b9689 fix: skip writing the file if the contents haven't changed
- siderolabs/talos@ecee92c90 fix: do not panic in
merge.Merge
if map value is nil - siderolabs/talos@c2259bff3 feat: update Go 1.21.5, Linux 6.1.65, etcd 3.5.11
- siderolabs/talos@c4dff49b3 release(v1.6.0-beta.0): prepare release
- siderolabs/talos@d8a435f0e fix: initialize boot assets with defaults early
- siderolabs/talos@c6835de17 fix: pick etcd adverised addresses from 'current' addresses
- siderolabs/talos@6b5bc8b85 feat: update Linux to 6.1.64
- siderolabs/talos@e71e3e416 feat: support extra arguments for
flanneld
- siderolabs/talos@36c8ddb5e feat: implement ingress firewall rules
- siderolabs/talos@0b111ecb8 fix: support slices of enums and fix NfTablesConntrackStateMatch
- siderolabs/talos@9a8521741 feat: improve nftables backend
- siderolabs/talos@db4e2539d feat: update Kubernetes 1.29.0-rc.1 and other bumps
- siderolabs/talos@7a4a92854 feat: support sanitized kernel args
- siderolabs/talos@f041b2629 chore: add tests for mdadm extension
- siderolabs/talos@e46e6a312 feat: implement nftables backend
- siderolabs/talos@ba827bf8b chore: support getting multiple endpoints from the
Provision
rpc call - siderolabs/talos@dd45dd06c chore: add custom node taints
- siderolabs/talos@8e2307466 docs: fix talosctl pcap argument
- siderolabs/talos@e4a050cb1 docs: fix talosctl inspect dependencies example indentation
- siderolabs/talos@fbcf4264f docs: fix talosctl dashboard cli docs
- siderolabs/talos@70d53ee13 chore: deprecate .persist and .extensions
- siderolabs/talos@95e33f6fc release(v1.6.0-alpha.2): prepare release
- siderolabs/talos@514e514ba feat: update Linux 6.1.63, containerd 1.7.9
- siderolabs/talos@aca8b5e17 fix: ignore kernel command line in container mode
- siderolabs/talos@020a0eb63 docs: fix table formatting for bootstraprequest
- siderolabs/talos@0eb245e04 docs: fix talosctl pcap example indentation
- siderolabs/talos@de6caf534 docs: fix table formatting for machineservice api
- siderolabs/talos@27d208c26 feat: implement OAuth2 device flow for machine config
- siderolabs/talos@5c8fa2a80 chore: start containerd early in boot
- siderolabs/talos@95a252cfc docs: fix link in what is new page
- siderolabs/talos@0d3c3ed71 feat: support kube scheduler config
- siderolabs/talos@06941b7e5 fix: allow rootfs propagation configuration for extension services
- siderolabs/talos@57dc796f3 docs: update lastRelease to v1.5.5 in _index.md
- siderolabs/talos@21d944a64 docs: add timezone information
- siderolabs/talos@4f1ad16c7 feat: support kubelet credentialprovider config
- siderolabs/talos@71a3bf0e3 fix: allow extra kernel args for secureboot installer
- siderolabs/talos@f38eaaab8 feat: rework secureboot and PCR signing key
- siderolabs/talos@6eade3d5e chore: add ability to rewrite uuids and set unique tokens for Talos
- siderolabs/talos@e9c7ac17a fix: set max msg recv size when proxying
- siderolabs/talos@e22ab440d feat: update Linux 6.1.61, containerd 1.7.8, runc 1.1.10
- siderolabs/talos@8245361f9 feat: show first 32 bytes of response body on download error
- siderolabs/talos@75d3987c0 c...