Update siderolabs/talos to v1.10.2 #208
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.9.4
->1.10.2
Release Notes
siderolabs/talos (siderolabs/talos)
v1.10.2
Compare Source
Talos 1.10.2 (2025-05-16)
Welcome to the v1.10.2 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.12.27
Talos is built with Go 1.24.3.
Contributors
Changes
12 commits
1cf5914
release(v1.10.2): prepare release44083c6
feat: update Linux to 6.12.2778df89b
fix: disable automatic MAC assignment to bridge interfacesa5de48b
fix: selinux detection92dcddd
fix: consistently apply dynamic grpc proxy dialerb8f1bde
chore: rotate aws iam credentialse6b33e2
chore: update sops keysb7e5741
test: fix the process runner log collection9e71cc8
fix: upgrade go-kubernetes for DRA flag bug5588560
test: fix some flaky testsb183f95
fix: k8s 1.32->1.33 upgrade check4b27faf
fix: improve volume mounter automatonChanges from siderolabs/go-kubernetes
2 commits
9070be4
fix: remove DynamicResourceAllocation feature gate8cb588b
fix: k8s 1.32->1.33 upgrade checkChanges from siderolabs/pkgs
4 commits
b425b44
feat: update NVIDIA drivers88034a5
feat: update ZFS to 2.3.287ce8f7
feat: update Linux to 6.12.27c0af3b8
feat: update Go to 1.24.3Changes from siderolabs/tools
1 commit
fa51331
feat: update Go to 1.24.3Dependency Changes
Previous release can be found at v1.10.1
Images
v1.10.1
Compare Source
Talos 1.10.1 (2025-05-07)
Welcome to the v1.10.1 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Contributors
Changes
16 commits
52269e8
release(v1.10.1): prepare release5c4f5a1
fix: multiple logic issues in platform network config controllerc881e6a
fix: deny apply config requests without v1alpha1 in "normal" mode5c64e7c
fix: interactive installer config gen46c30f3
fix: generate iso greater than 4 gig33401be
fix: skip PCR extension if TPM1.2 is found77078ff
fix: containerd crashing with sigsegv3956144
fix: ignore http proxy on grpc socket dialeb6d98b
fix: suppress duplicate platform config updates6a438ec
fix: do correct backoff for nocloud reconcile9d64f31
fix: drop libseccomp from rootfs29b2077
fix(ci): provision tests52afece
fix(ci): bios provision test208503c
test: update hydrophone to 0.7.0649d0f8
chore(ci): add extensions test for Youki runtimee37573e
fix: relax etcd APIs RBAC requirementsChanges from siderolabs/pkgs
3 commits
13e9f09
fix: build containerd with Go 1.23bdee168
fix: containerd build doesn't need seccomp61c59a4
fix: downgrade libseccomp to 2.5.5Changes from siderolabs/tools
1 commit
67d3f5a
chore: update toolchain to the latest versionDependency Changes
b92baf7
-> v0.7.0Previous release can be found at v1.10.0
Images
v1.10.0
Compare Source
Welcome to the v1.10.0-alpha.3 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
auditd
Kernel parameter
talos.auditd.disabled=1
can be used to disable Talos built-inauditd
service.cgroups v1
Talos Linux no longer supports
cgroupsv1
when running in non-container mode.The kernel argument
talos.unified_cgroup_hierarchy
is now ignored.Disk Image
Talos starting with 1.10 will have disk images that will use GRUB only for legacy BIOS and systemd-boot for modern UEFI systems.
On first boot Talos determines the boot method and will wipe the unused bootloader.
Secureboot disk-images will be sd-boot only.
For ARM64 imager will still generate GRUB bootloader for Talos < 1.10 and for Talos >= 1.10 all ARM64 boot assets will use systemd-boot.
Imager supports overwriting bootloader when generating a disk image via the Imager profile
output
option.Eg:
Driver Rebind
Talos 1.10 now supports a new machine config document named
PCIDriverRebindConfig
that allows rebinding the driver of a PCI device to a different target driver.See the documentation for more information.
Ethernet
Talos now provides
ethtool
-style Ethernet low-level configuration vianetwork/EthernetConfig
documents.Current status of the interface can be read by
talosctl get ethernetstatus
.Machine Install Extensions
.machine.install.extensions
will have no effect starting from Talos 1.10, the machine config document field is still kept so upgrades from older versions are possible.Use Boot Assets instead.
Extra Kernel Args
Talos 1.10 on fresh install on UEFI systems will now use systemd-boot and UKIs (Unified Kernel Images)[https://uapi-group.org/specifications/specs/unified_kernel_image/].
This means the kernel command line arguments are part of the UKI and cannot be modified without an upgrade to a new UKI.
Upgrades to Talos 1.10 will preseve the existing bootloader (GRUB for non-secureboot) and sd-boot for Secureboot and this change will have no effect.
To build a boot asset with extra kernel arguments whether an
installer
or a boot image use either Image Factory orImager.
This means kernel arguments not part of the UKI will not be preserved across updates and a proper installer image generated via Imager Factory or Imager is required.
Ingress Firewall
Talos Ingress Firewall now filters access to Kubernetes NodePort services correctly.
iSCSI Initiator
Talos now generates
/etc/iscsi/initiatorname.iscsi
file based on the node identity which is tied to the lifecycle of the node.If using
iscsi-tools
extension, starting with Talos 1.10 would have a more deterministic IQN for the initiator node.Make sure to update any iSCSI targets to use the new initiator IQN.
The iqn can be read by
talosctl read /etc/iscsi/initiatorname.iscsi
ISO
Talos starting with 1.10 will have ISO's that will use GRUB only for legacy BIOS and systemd-boot for modern UEFI systems.
kube-apiserver Authorization Config
When using
.cluster.apiServer.authorizationConfig
the user provided order for the authorizers is honoured andNode
andRBAC
authorizers are always added to the end if not explicitly specified.Eg: If user provides only
Webhook
authorizer, the final order will beWebhook
,Node
,RBAC
.To provide a specific order for
Node
orRBAC
explicitly, user can provide the authorizer in the order they want.Eg:
Usage of
authorization-mode
CLI argument will not support this form of customization.NVMe NQN
Talos now generates
/etc/nvme/hostnqn
and/etc/nvme/hostid
files based on the node identity which is tied to the lifecycle of the node.The NQN can be read by
talosctl read /etc/nvme/hostnqn
Fully bootstrapped builds
Talos 1.10 is built with a toolchain based on [Stageˣ], which is a project building fully bootstrapped software.
This change increases reproducibility, auditability and security of Talos builds.
This also changes Talos root filesystem structure for unified /usr, with other directories symlinking to /usr/bin and /usr/lib.
System extensions must move their directories accordingly for 1.10.
Component Updates
Talos is built with Go 1.24.1.
Contributors
Changes
270 commits
a834219ac
chore: update dependencies857779b90
docs: clarify custom CA certificate with KMS STATE encryption39ed45ae6
docs: add information about Cilium exclusive CNI087a85f40
feat: support running with SELinux enforcingd4aacb0d8
refactor: mount operation for STATE and user disks44f3c7248
fix: kata extension7ca5ab5e9
fix: shrink installer and imager imagesea0994cfe
fix: kexec with smbios type 11 string8e20a5d28
fix: pass /usr/etc/in-container to apid, trustd and extension containers9b9512ba8
feat: update Linux 6.12.19, containerd 2.0.4433b0237b
fix: correct structprotogen example6e68a522a
chore: fix conformance artifact namef592730d9
fix(ci): fix image cache testcc6c714ce
feat: add Tegra modules to initrd81d1fe0f8
fix: add missing TOOLS_PREFIX for WITH_DEBUG_SHELL builds3e38bf6d4
fix: ignore missing config (nocloud) via cidata27a4486a8
docs: fix typo cluser -> clusterac79b1ea0
feat: pull in Intel STTMAC network drivers9bb5c060c
chore: bump go-kubernetes2b8e08234
feat: deprecate.machine.install.extensions
b7446372b
docs: add documentation on unofficial SBC forks9bec765c4
feat: talosctl kubeconfig write to stdout option11ebb1078
fix: kexec when using sd-boot61f1a32d2
test: allocate more resources for conformance runsb8b7b83f8
chore: extraKernelArgs validation for UKI'se2df0c6d3
docs: update siderolink.mdf9b14e784
fix: reconnect on SideroLink tunnel on/off change29f7b3bf3
test(ci): use k8s websocket executor for tests9531c1c6d
fix(ci): image-cache cron90abdc489
feat: update Kubernetes to 1.33.0-beta.09a5914048
refactor: ephemeral mounte4fb1c06a
docs: update for predictable interface naming729fce306
feat: update Linux to 6.12.18b4d2e1c3c
fix: typo in machinery CloudPlatforms7e0475488
fix: qemu: archive cluster logs only after stopping VMsdab30a8b9
fix: ensure no goroutines escape in dns controllerfce824e2f
fix: change from "init6" to "inet6" in docsf51ebd1bc
chore: fix the mount cache ids in the Dockerfile4365aecbd
test: use standard installer for e2e-iso431178327
feat: update Kubernetes to v1.33.0-alpha.31259345e4
fix(ci): image-cache cron18871a7eb
chore: tidy labeled-squashfs.shd45259f89
feat: update Flannel to 0.26.5e83ef0e2e
docs: update proxmox.md3def5f9a6
feat: update etcd to 3.5.19c3c0d2e42
test: fix dns test in race mode17965c32f
chore: update Go to 1.24.11fbb2d1a7
docs: update nvidia-gpu-proprietary.mdd60972bdf
chore: add installer-base to the list of signed imagesab6cb3dfa
chore: disable azure upload2355218e4
release(v1.10.0-alpha.2): prepare released4e3e957c
fix(ci): fix integration tests1849b5388
feat: update dependencies88fc6bbeb
test: fix UKI preserving talos.config and image cacheba8cd304d
test: enable image-cache in the cron28b5dc738
test: fix reproduciblity test50998038b
feat: prefer sd-boot for UEFIe831e52e0
feat: add support for qla2xxec5c049a5
feat: update Kubernetes to 1.33.0-alpha.2ebfa82f35
docs: update deprecated commandd79059a2c
chore: fix shutdown typo in shutdown sequencea3f88d2ef
fix: block NodePort services with ingress firewallfd8131cb8
feat: generate unified installerebfdb91b4
fix: handle dynamic HTTP proxy settings for discovery clientd45eaeb74
fix: correctly map link names/aliases when using VIP operator7c4e47c0c
chore: stop doing generate on each buildb1d410cb6
feat: dual boot disk image468e318ba
fix: multiple fixes for dashboard/no data3dd8d9aed
docs: update resetting-a-machine.md to include example of reset7af8f6b2f
feat: validate docker image references in upgrade optionsc949f55e6
docs: remove typo on resetting a machine pagef5c097041
feat: add description to schema object defs79ee304e1
chore: update enumer to a version that fixes Go 1.24 compatibility46d67fe44
chore: update Go to 1.24, update pkgs7f1dd2669
fix(ci): fix integration-misc crons26a773d3f
docs: add a note about syslog sending messages to services7ce053638
fix: ignore digest part of images when checking versionae1b00354
feat: support noclooud instance-id from dmi58661dea7
docs: update getting-started.md94cf9fb84
chore: fix spurious generate failures32a34791e
fix: typo in Makefile target talosctl-freebsd-arm641b4464c8a
feat: update Kubernetes to 1.32.29463ac23e
fix: make ingress firewall filter traffic to nodeports8531d91a1
fix: blockdevice transport detectionce616d93a
fix: path for ca-certificatesf35b58779
fix: fix diff printingbf0f910a1
chore: provide more logging for dns requests607998ba2
feat: support uki profiles via imager711cf2d99
fix: ignore errors to stop pods142d75483
fix: handle empty registry config47f377b21
feat: implement the last ethtool feature - channels88cf69b8c
feat: multi profile UKIs557faad75
feat: update Linux to 6.12.135dbf9e350
refactor: implement volume mount controlleraa11e9abb
fix: make image cache volume management less strict26a62e342
docs: fix typo in Wireguard docs0419f5d8b
feat: implement features inethtool
-like supportcd66fc6e8
feat: use bootstrapped packages for building Talos2b5bd5d1d
chore: upgrade siderolabs/go-loadbalancer15191aa3e
fix: extract cmdline multi profile UKIs716f700da
feat: provide initial support for ethtool configurationb726e2f9f
feat: update Flannel to 0.26.498d56d4d6
chore: track opened grpc connections5e28c8e03
fix: image cache volume provisioningc9667813d
chore: remove containerd importer270ffb69a
fix: duplicate qemu drive ids71ec41be1
fix: build of Talos on non-Linux hoste2aa7c98c
fix: installer with SecureBoot should contain UKIs6e22c06c3
release(v1.10.0-alpha.1): prepare release3a2d9867b
fix: do not close client.Client.conn with finalizer73f30ff25
feat: bump pkgs for udev updateaea90cb8f
docs: update hyper-vb7165615f
fix: use local NTP for AWS platform673ca4bcb
fix: ensure proper closure of client.Client.conn with finalizer19040ffd6
fix: handle of PE sections with duplicate names83489d348
docs: add note about vmxnet and flannel conflictf1292f5e7
docs: add iscsi-tools extension to prerequisites93b4a3740
test: bump timeout on rotate CA test42e166984
feat: support kexec from uki8da264946
docs: add Orange Pi 5 to Image Factory platforms and documentationc5fb62e2e
feat: update Linux to 6.2.1183d007c16
feat: update etcd to 3.5.18edf7c3288
fix: pe uki extract70f72c5b0
docs: update multus.md807a3cd29
refactor: all network merge controllersec8c4660e
docs: update vmware.mdbaf81cd49
fix(ci): k8s integration suite wait for resourcecd5e54903
feat: generate iso's with both UKI and grub75673b6a3
feat: provide stable symlinks in disk resourcesf407c88e4
fix(ci): wait for longhorn node resource601cdccb9
feat: extract kernel/initrd from uki for grubff175b9fb
docs: update disk-encryption.mda8d84e315
docs: fix typos and add more explanations in docs3a384240e
fix: invalid date field in iqn/nqn82c9ec158
chore(ci): add tests with longhorn v2 engine689ea1dbf
fix: bring back disk UUID7a712fad2
fix: disks with 4k sector size and systemd-bootd62a34aaf
feat: update tools/pkgs/extrasb9a8ad6ac
chore: de-hardcode list of extra images for image-cache test683153a33
docs: remove the last mentions ofpreserve
flag for Talos 1.8+33c7f4195
docs: fix typo an MacOS to on MacOS21cff3919
chore(ci): fio benchmark results as separate artifacts0b7fc7cdf
fix: abort node watch on hostname change99ba53941
docs: remove the mention ofpreserve
flag for Talos 1.8+bde516fde
chore(ci): rework iscsi-tools extensions teste1efbf656
refactor: extract platform metadata into Talos machinery79987c05d
feat: generate iqn and nqn files0cab6ed17
docs: update troubleshooting.md921e10254
chore: update Go to 1.23.5399d53b54
fix: ignore forbidden error when waiting for pod eviction8dea57a81
fix: make etc binds read-only63157dcb4
docs: update SideroLinkConfig examplefc7080e34
chore: clear cache after updating upstreams51e0f273f
docs: update documentation for Talos 1.9.2e06b14112
feat: update Kubernetes to 1.32.14310b290d
fix: generate UKI only if actually neededa8cd99102
docs: update OpenEBS Mayastor installationcf45f4764
docs: add Radxa ROCK 5B docs to Single Board Computer sectionb21bdc5e5
chore(ci): save csi tests fio results01c86832c
chore(ci): add test for OpenEBS MayaStorc77483510
test: updatetalosctl debug air-gapped
ddd695d93
feat: update containerd to 2.0.2da2e81120
fix: add informer resync period for node status watcher9b957df64
chore: uki code restructuree41a99525
fix: kube-apiserver authorizers orderdb4ca5668
feat: add a kernel parameter to disable built-in auditdfaa149003
feat: update Linux to 6.12.98de19758d
fix: a couple of imager panics/crashes5bc3e34cb
fix: detect GPT before ZFSed7e47d15
refactor: drop usage of objcopy to generate UKIsedf5c5e29
fix: extfs repair and resize6e32ea5b7
fix: merge of VolumeConfig documents with sizes1be5f8ff2
feat: update Linux to 6.12.8e6a4583ba
feat: support generating unsigned UKIsbbd6067d4
fix: partition alignment on disks with 4k sectors84fcc976f
fix: yet another dashboard panic6d605fc85
fix: disable NRI plugin in a different way499695e24
fix: request previous IP address in discoverycc84caf8c
docs: update Cilium documentationfa5300d91
chore: revert: drop deprecated allowSchedulingOnMasters0abb3dabf
docs: fix command to wait for ceph-rook HEALTH_OK32c67c27c
chore: drop deprecated allowSchedulingOnMastersae6d065be
fix: mount selinuxfs only when SELinux is enabled5ccbf4bcd
feat: enableconfigfs
59582496d
feat: bring in partity with sd-25783d84a831
chore(ci): better zfs checks650eb3a4f
refactor: rewrite cloud uploader to use AWS SDK Go v201bf8449b
fix: update field name for bus path disk selectore915c98d5
fix: exclude disks with empty transport for disk selectorb7a7fdc4b
refactor: generate /etc/os-release file static waye79c9e127
chore(ci): drop equinix metal e2e-test418945444
fix: build of talosctl on non-Linux platforms4761a9e6a
chore: update dependenciesf98efb333
fix: ignore member not found error on leave clusterb72bda0a4
fix: talosctl support and race tests27233cf0f
test: use node informer instead of raw watch5dc15e8db
fix: update go-blockdevice to v2.0.95f3acd0f2
fix: use correct default search domain7e5d36d46
fix: pci driver rebind config validation4b97bbc3f
fix: pull in containerd CNI deadlock fix066480722
test: fix apparmor tests82ea44a6b
fix: reduce installer image78b3e7f4f
fix: get next rule number for IPv6 in the appropriate chain675854aa0
docs: fix two typosf70b7386a
test: add a xfs makefs test8212e4864
refactor: use quirks in kernel argsb4aa5189d
release(v1.10.0-alpha.0): prepare releasebd85bd5b7
fix: fixFailed to initialize SELinux labeling handle
udev error73c82e3e5
feat: bring Linux 6.12.6, CNI plugins 1.6.1c12b52491
docs: document Kubernetes service registry incompat with K8s 1.32a5660ed77
feat: pcirebind controller4c3261626
docs: fix several typosfb3675321
fix: dashboard crash on CPU datadec0185c8
chore: reduce memory usage for secureboot functionscee6c60a0
fix: make talosctl time work with PTP time syncf75604313
chore: support gcr.io auth for cache and image gen6ef2596da
docs: improve Hetzner documentation7d39b9ec2
feat: remove cgroupsv1 in non-container mode8003536c7
fix: restore previous disk serial fetching03116ef9b
chore: prepare for Talos 1.1000682fdd6
docs: activate 1.9 docs as defaultbea05f5c9
docs: update deploying-cilium.md284ab1179
feat: support link altnames/aliases5bfd829bf
docs: fix 'containter' typo8d151b771
docs: clarify TALOSCONFIG for AWS0ef19171f
fix: renovate typoc568adc7d
fix: renovate configec2e24fd9
fix: match MAC addresses case-insensitive (nocloud)41a0c440a
chore: rekres for renovate changesa49bb9ee4
feat: update Linux to 6.12.5b15917ecc
chore: add more debugging logs for META and volumes2b1b326f0
docs: mention different paths for OpenEBS9470e842f
test: cleanup failed Kubernetes podsc9c685150
fix: node identity flip590c01657
feat: update containerd to v2.0.118fa5a258
docs: update image-cache doc for isoab5bb6884
fix: generate and serve registries with port58236066d
fix: support image cache on VFAT USB sticke193a5071
fix: image cache integration test08ee400fd
test: fix flaky test NodeAddressSortd45e8d1d1
feat: update Kubernetes to 1.32.0136b12912
chore: drop semicolon for supporting vfat filesystems3e9e027ef
test: add an option to boot from an USB stickef8c3e3b3
docs: fix typo in multus.mdd54414add
fix: authorization config gencce72cfe8
docs: replace deprecated Hetzner server plans81805103d
chore: enable proper parallel usage of TestDepthe1b824eba
docs: update ceph-with-rook.md470b75563
fix: use mtu network option for podman61b1489a0
fix: order volume config by the requested sizebc3039acd
feat: update runc to 1.2.330016a0a8
fix: avoid nil-pointer-panic inRegistriesConfigController
fe0457152
fix: power on the machine on reboot request in qemu power api10da553ef
docs: build what's new for 1.9d946ccae3
feat: update Linux to 6.12.4707a77bf6
test: fix user namespace test, TPM2 fixesc3537b2f5
feat: update Linux to 6.12.3cb4d9d673
docs: fix a few mistakes in release notesc4724fc97
chore: add integration tests for image-cache07220fe7f
fix: install iptables-nft to the host14841750b
chore: add version compatibility for Talos 1.10852baf819
feat: support vlan/bond in v1, vlan in v2 for noclouddd61ad861
fix: lock provisioning order of user disk partitionsd0773ff09
chore: update Go to 1.23.47d6507189
feat: implement new address sorting algorithm9081506d6
feat: add process scheduling options77e9db4ab
test: use two workers in qemu tests by default5a4bdf62a
feat: update Kubernetes to 1.32.0-rc.1d99bcc950
chore: refactor mergeDNSServers func0cde08d8b
docs: add Turing RK1 docs to Single Board Computer sectionChanges since v1.10.0-alpha.2
49 commits
a834219ac
chore: update dependencies857779b90
docs: clarify custom CA certificate with KMS STATE encryption39ed45ae6
docs: add information about Cilium exclusive CNI087a85f40
feat: support running with SELinux enforcingd4aacb0d8
refactor: mount operation for STATE and user disks44f3c7248
fix: kata extension7ca5ab5e9
fix: shrink installer and imager imagesea0994cfe
fix: kexec with smbios type 11 string8e20a5d28
fix: pass /usr/etc/in-container to apid, trustd and extension containers9b9512ba8
feat: update Linux 6.12.19, containerd 2.0.4433b0237b
fix: correct structprotogen example6e68a522a
chore: fix conformance artifact namef592730d9
fix(ci): fix image cache testcc6c714ce
feat: add Tegra modules to initrd81d1fe0f8
fix: add missing TOOLS_PREFIX for WITH_DEBUG_SHELL builds3e38bf6d4
](https://redirect.github.com/siderolabs/talos/commit/3e38bfConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.