v1.6.2

[smira]

Talos 1.6.2 (2024-01-18)

Welcome to the v1.6.2 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.1.73

Talos is built with Go 1.21.6.

Contributors

• Andrey Smirnov
• Utku Ozdemir
• Dmitriy Matrenichev
• Drew Hess
• Hervé Werner
• JJGadgets
• Jonomir
• Serge Logvinov

Changes

16 commits

• 26eee7553 release(v1.6.2): prepare release
• f87a0468b fix: strategic patch merging for audit policy
• 36b913dba fix: watch bufer overrun for RouteStatus
• 3576d113c fix: fix .der output in talosctl gen secureboot
• 0191c3b2c fix: support KubePrism settings in Kubernetes Discovery
• 8fa6e93f0 fix: force KubePrism to connect using IPv4
• e05eebca1 fix: update kmsg with utf-8 fix
• 37bfa60dd fix: merge ports and ingress configs correctly in NetworkRuleConfig
• 306c5cad2 fix: fix nodes on dashboard footer when node names are used in --nodes
• 530332d24 fix: disk UUID & WWID always empty in talosctl disks
• 440f56341 chore: pull in NBD modules
• 3ebdbabaf fix: default priority for ipv6
• b47619543 fix: replace the filemap implementation to not buffer in memory
• 0ec551597 fix: imager should support different Talos versions
• 4b3168624 feat: support iPXE direct booting in talosctl cluster create
• d98699c07 feat: update Linux 6.1.73, go 1.21.6

Changes from siderolabs/go-kmsg

2 commits

• siderolabs/go-kmsg@e358d13 fix: decode escape sequences while reading from kmsg
• siderolabs/go-kmsg@4297bd5 feat: add BSD support

Changes from siderolabs/pkgs

3 commits

• siderolabs/pkgs@0078a66 feat: enable NBD
• siderolabs/pkgs@31b9d61 feat: enable nct6683 sensors as module
• siderolabs/pkgs@f8c6a35 feat: go 1.21.6, linux 6.1.73

Changes from siderolabs/tools

1 commit

• siderolabs/tools@5e034ec feat: update Go to 1.21.6

Dependency Changes

• github.com/pin/tftp 2f79be2dba4e new
• github.com/siderolabs/go-kmsg v0.1.3 -> v0.1.4
• github.com/siderolabs/pkgs v1.6.0-9-g8fa73db -> v1.6.0-12-g0078a66
• github.com/siderolabs/talos/pkg/machinery v1.6.1 -> v1.6.2
• github.com/siderolabs/tools v1.6.0-1-g336d248 -> v1.6.0-2-g5e034ec
• golang.org/x/sys v0.15.0 -> v0.16.0

Previous release can be found at v1.6.1

Images

ghcr.io/siderolabs/flannel:v0.23.0
ghcr.io/siderolabs/install-cni:v1.6.0-1-g113887a
registry.k8s.io/coredns/coredns:v1.11.1
gcr.io/etcd-development/etcd:v3.5.11
registry.k8s.io/kube-apiserver:v1.29.0
registry.k8s.io/kube-controller-manager:v1.29.0
registry.k8s.io/kube-scheduler:v1.29.0
registry.k8s.io/kube-proxy:v1.29.0
ghcr.io/siderolabs/kubelet:v1.29.0
ghcr.io/siderolabs/installer:v1.6.2
registry.k8s.io/pause:3.8

---

This discussion was created from the release v1.6.2.

[smira]

Known issue on Raspberry Pi: #8195

[eremid]

Hello,

I recently upgraded my cluster from version 1.6.1 to 1.6.3, and I suspect that I'm encountering an issue related to the following commit:

• 8fa6e93f0 fix: force KubePrism to connect using IPv4

In version 1.6.3, KubePrism now uses 127.0.0.1 instead of localhost. This results in the following warnings:

 user: warning: [2024-01-31T11:53:18.418057858Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.ManifestApplyController", "error": "error creating mapping for object /v1/Secret/bootstrap-token-pku6yn: Get \"https://127.0.0.1:7445/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.10.10.3, 10.10.10.79, 10.96.0.1, not 127.0.0.1"}
 user: warning: [2024-01-31T11:53:18.597827858Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.KubeletStaticPodController", "error": "error refreshing pod status: error fetching pod status: an error on the server (\"Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)\") has prevented the request from succeeding"}
 user: warning: [2024-01-31T11:53:20.885725858Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.NodeApplyController", "error": "1 error(s) occurred:\n\terror getting node: Get \"https://127.0.0.1:7445/api/v1/nodes/talos-o20-aa1?timeout=30s\": tls: failed to verify certificate: x509: certificate is valid for 10.10.10.3, 10.10.10.79, 10.96.0.1, not 127.0.0.1"}
 user: warning: [2024-01-31T11:53:23.800745858Z]: [talos] node watch error {"component": "controller-runtime", "controller": "k8s.NodeStatusController", "error": "failed to list *v1.Node: Get \"https://127.0.0.1:7445/api/v1/nodes?fieldSelector=metadata.name%3Dtalos-o20-aa1&limit=500&resourceVersion=0\": tls: failed to verify certificate: x509: certificate is valid for 10.10.10.3, 10.10.10.79, 10.96.0.1, not 127.0.0.1"}
 user: warning: [2024-01-31T11:53:29.443526858Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.ManifestApplyController", "error": "error creating mapping for object /v1/Secret/bootstrap-token-pku6yn: Get \"https://127.0.0.1:7445/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.10.10.3, 10.10.10.79, 10.96.0.1, not 127.0.0.1"}
 user: warning: [2024-01-31T11:53:34.182992858Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.KubeletStaticPodController", "error": "error refreshing pod status: error fetching pod status: an error on the server (\"Authorization error (user=apiserver-kubelet-client, verb=get, resource=nodes, subresource=proxy)\") has prevented the request from succeeding"}
 user: warning: [2024-01-31T11:53:46.505197858Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.ManifestApplyController", "error": "error creating mapping for object /v1/Secret/bootstrap-token-pku6yn: Get \"https://127.0.0.1:7445/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.10.10.3, 10.10.10.79, 10.96.0.1, not 127.0.0.1"}
 user: warning: [2024-01-31T11:54:01.284203858Z]: [talos] node watch error {"component": "controller-runtime", "controller": "k8s.NodeStatusController", "error": "failed to list *v1.Node: Get \"https://127.0.0.1:7445/api/v1/nodes?fieldSelector=metadata.name%3Dtalos-o20-aa1&limit=500&resourceVersion=0\": tls: failed to verify certificate: x509: certificate is valid for 10.10.10.3, 10.10.10.79, 10.96.0.1, not 127.0.0.1"}
 user: warning: [2024-01-31T11:54:14.050888858Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.ManifestApplyController", "error": "error creating mapping for object /v1/Secret/bootstrap-token-pku6yn: Get \"https://127.0.0.1:7445/api?timeout=32s\": tls: failed to verify certificate: x509: certificate is valid for 10.10.10.3, 10.10.10.79, 10.96.0.1, not 127.0.0.1"}

I have encountered a similar problem in kube-scheduler, among other components.

Is there an issue with my configuration ? If I add 127.0.0.1 to the certSANs in machineconfig, is there a way to regenerate the certificates ?
Thanks for your help !

[smira]

Talos 1.6.3 automatically injects 127.0.0.1 as the certSAN, but you need to follow the recommended upgrade sequence - controlplanes first, followed by worker machines.

It might take a minute or two before KubePrism finds a proper host while upgrading the HA controlplane.