v1.11.0-beta.0

[Unix4ever]

Omni 1.11.0-beta.0 (2026-09-01)

Welcome to the v1.11.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Frontend Quality-of-Life Improvements

Align the UI features on the Cluster scale and Cluster create pages. Support searching by labels on Cluster scaling/create pages.

Install Disk Configs

Config Patches can no longer be used for setting Talos install disk. Starting from Talos 1.14 installation flow was changed a lot so setting the install disk in the configs will no longer work. Install disk is now defined in a separate resource and works differently for the older Talos versions.

Kubernetes Token Signing Keys

Admins can now list the keys that sign Kubernetes access tokens and delete them. Deleting one immediately invalidates every kubeconfig and OIDC token it signed, which is what it takes to pull a long-lived service account kubeconfig out of circulation before it expires.
See documentation for more details.

Recovery Admin for SAML Lockouts

auth.recoveryAdmin config, or the --recovery-admin flag can be used to elevate a user to Admin on every Omni start.
It also blocks user demotion through SAML label rules. This is the way back in when a SAML rule strips Admin from everyone. Only existing users can be promoted.

Contributors

• Edward Sammut Alessi
• Oguz Kilcan
• Spencer Smith
• Utku Ozdemir
• Mateusz Urbanek
• Kevin Tijssen
• Andrey Smirnov
• Artem Chernyshev
• Orzelius
• Noel Georgi
• Tim Jones

Changes

103 commits

• 92d72412e release(v1.11.0-beta.0): prepare release
• e402ff4ef chore: remove oauth2 client credentials auth for the image factory
• e460ae71e fix: retry a rejected bootstrap request at the next check
• b1341200b feat: authenticate PXE installation media with a download token
• b7b58efe8 feat: download installation media through the boot asset API
• e2ad5e43f refactor: rename the boot asset API to installation media URL
• f573426e4 test: fix a race between manual machine picks and machine classes
• 605a83da9 fix: apply pending updates to unhealthy machines so they can recover
• 9b6d554a3 feat(frontend): use download tokens for installation media
• 2491f1437 fix(frontend): fix filter check in pending machines
• fbaa7fb18 feat: regularly reconcile factory access tokens in cosi
• 23cc61d91 feat: add image factory token resource
• 1eecc480a feat: add image factory oauth2 client config
• a96ef43d2 chore: bump deps and default versions
• 36bd2eccc fix: mark a cluster as bootstrapped only once etcd is running on the node
• 71ee3ad80 test: fix a race in the preserve-features machine config test
• 3794b1177 feat: authenticate boot asset downloads with image factory tokens
• 4bbd713da refactor: move the cluster and metrics controllers into their packages
• ace063b53 fix: record the image factory host for machines already at target
• 8c003994b test: adapt the integration tests to Talos 1.14
• 78d56b38d chore: prepare Omni for Talos 1.14
• e37ab210b test: trim redundant legacy manifest group id cases
• f8b9cfc30 fix: migrate legacy weighted one-time manifest group ids
• c76cf4b7c test: increase timeouts for sqlitelog cleanup tests
• 9630157c3 fix: correct manifest group ownership comparison
• 20afcdacb fix: drop numeric prefix from manifest group ids
• d50ea9a57 fix: drop manifest apply-order weighting and fix stale status tracking
• 58d1897a2 feat(frontend): hide machine creation commands not supported by enterprise
• fc8d3d150 feat(frontend): use cross-browser scroll styling
• 7bc0852b9 feat: proxy security reports through omni
• 1c6369866 fix(frontend): remove credentials from cluster create url
• 8c3f12d72 chore: bump deps
• cbbfd9ffe chore: bump go
• b024ef98a fix: change incorrect version contract for kubespan
• b1ea5df26 fix: properly clean up pods of the health check jobs
• cc3717ac6 fix: provide machine id consistently in provision API logs
• c9d6d489b fix: add missing timeout to the version API call in the identity task
• c19abe332 fix: stop a link to an exposed service from starting a login flow
• 80c4a4557 feat: manage the install disk with a first-class resource
• d0ecc7b3f chore: rekres and bump deps
• 84856105e refactor(frontend): drop luxon in favor of date-fns
• b6f64c6b7 chore: bump deps
• ee0704f79 feat: allow listing and deleting the Kubernetes token signing keys
• d7bef774d feat(frontend): add filename param to image downloads
• c574e432d fix: siderolink api label
• 44aa6f524 test: increase test timeouts
• d6b8c33e3 test: run talemu suite in both chrome and firefox
• a0b13882c test: replace omni.localhost with ci.test
• 8378899c0 test: consolidate all host references to common.sh variables
• 0051462aa feat: serve infra provider boot assets through Omni
• 008d9300e chore: rekres and add gitattributes block
• 18854ce46 refactor(frontend): replace remaining update:xxx locations to v-model
• 270d06711 fix(frontend): fix etcd backup interval not editable
• 3798a6d8d feat: add a recovery admin for SAML lockouts
• f2aeaa851 fix(frontend): check for navigation in preload error events
• b56929e10 chore: bump deps
• 4c283a3bf chore: rekres and bump go
• cfa05aa5a fix(frontend): fix incorrect machine route params
• 0f029dcec feat(frontend): add filtering and pagination to cluster scale
• 91a0e612d feat(frontend): use labels input in cluster create
• 11ecf9522 refactor(frontend): extract label completions query from input
• 76fc80dab test(frontend): fix a typo in test regex
• bcf658e7f refactor(frontend): drop deprecated getcontext
• 3efa4c63c test: make integration tests pass against a non-CI Omni instance
• 71b3a9e41 test: fix flaky unit tests on overloaded CI runners
• dbff80519 refactor(frontend): migrate machines away from tlist
• 4e7e354c0 refactor(frontend): migrate pending machines away from tlist
• ec2028cb3 refactor(frontend): move pagination reset logic into composable
• 0faf1cc1c refactor(frontend): lift filtering logic out of tlist
• b3845c074 refactor(frontend): lift pagination logic out of tlist
• ec0098668 refactor(frontend): lift sorting logic out of tlist
• b3967f439 fix(frontend): fix side panel sizing and allow control wrapping
• 5bed0cb85 refactor(frontend): lift sidePanel out of tlist
• c2f91ee19 refactor(frontend): lift addFilterLabel out of tlist
• 22d0972cd refactor(frontend): use pagination component inside tlist
• 8bcc1ad12 refactor(frontend): use reka-ui for pagination
• c1ae41c57 refactor(frontend): extract items out of pagination
• 4f299f8a8 refactor(frontend): rename tpagination to pagination
• a98f5ac0b refactor(frontend): rename arrow-* to chevron-* and use heroicons variants
• 0970a6db2 fix(frontend): fix reset wizard
• cc23658b0 fix: compress diffs in the machine pending updates and diff history
• 47845eb51 fix: force re-authentication at the IdP so logout takes effect
• 194c629cf fix: keep a machine's tunnel peer address stable across provisions
• 899128ec5 fix(frontend): return no-cache for index.html
• 3e01d4012 fix: don't sign users out of Omni on Kubernetes OIDC logout
• 4fad1c5b9 fix(frontend): add missing credentials to security pages
• 8c802ffd6 test(frontend): add edit patch e2e test
• 240964a2e fix(frontend): fix patch edit dropping fields
• d9c463dcc fix: backfill the image factory host of machines enrolled before 1.10
• 2c70b1541 fix: bound the machine config diff by bytes, not just lines
• 7a847f5c2 fix(frontend): be more defensive about signup errors
• dc6fa2246 chore(frontend): bump dependencies
• 38299fa8e test: verify upgrade drain honors grace period and aborts on failure
• 0a45ef095 chore: bump default versions
• 4d4e327d3 feat(frontend): use hostnames for machine list in delete modal
• 491d83ea2 feat(frontend): normalise the delete/remove text for machines
• 09a97cd63 feat(frontend): show config errors on all node pages
• 6455ba835 feat(frontend): sort talos/k8s versions newest first
• a2b38563e fix(frontend): adjust kubespan quick start text
• c55f2c2bd fix: never change a machine's tunnel address after registration
• 686be42f7 fix: log out of Omni and the IdP when /logout is opened directly
• 06a07defd fix: make SAML single logout survive retries and redirect binding
• 31e814fa3 test: add e2e-saml test class backed by a local Keycloak IdP

Changes from siderolabs/image-factory

44 commits

• b54b945 release(v1.6.0): prepare release
• 9244e82 feat: sign installer profile when unified secureboot supported
• 3b58dfa feat(enterprise): add a node tokens page
• 82bd329 feat: add node token methods to the factory client
• 9312d82 feat(enterprise): add self-issued node tokens
• 4691e01 feat: add WithTokenSource to include bearer tokens
• b115d17 chore(enterprise): drop the Auth0 Management API node-token design
• 6f08ed9 feat(enterprise): extend the download-token issuer to a second audience
• c51ac14 feat: accept download token on /pxe/ and forward it
• 7252d87 chore: allow proxying IF through IF
• f45ec71 fix(enterprise): read the org_id claim from if_org_id
• 43adb19 release(v1.5.1): prepare release
• 5f1f197 feat: update Talos to 1.14.0-rc.2
• b7908c1 feat(enterprise): add Auth0 Management API client for node tokens
• 36fedd7 feat: add WithBearerToken to include m2m token
• e783a3d feat(frontend): preserve whitespace for vuln descriptions
• 18f56f7 chore: make sure check-dirty also checks docs
• 196a447 fix: enforce canonical image references
• 26b95ca feat(enterprise): require auth0 clientID and clientSecret always
• 25561f7 fix: retry put when joining a failed get flight
• aab14ff feat: add spdx and vex reports to factory client
• dc6a9f9 feat(enterprise): theme and translate Auth0 logout/login-error pages
• bd13149 release(v1.5.0): prepare release
• d3c693a feat: update talos to v1.14.0-rc.1
• 5c9839a feat: use the CI cluster registry cache for integration tests
• 70e0590 feat(enterprise): add auth0 browser login
• f5f3128 fix: record the status the client actually received
• 0d2275c feat: make download token TTL configurable
• a5824c7 docs: complete user-facing API reference
• dd485bd docs: document endpoint access control
• 6016631 test: fix two flaky checks in the enterprise integration job
• f984ad8 chore: let the OIDC test server serve extra routes
• f297b62 chore: update Talos to the latest version
• 86b0a22 fix: re-identify cached SBOM bundles per schematic
• 77990dc fix: schedule grype db refresh to avoid replica desync
• ad14c5f feat(enterprise): publish installer build evidence
• dbcc3c6 feat: add auth0 bearer token authentication
• ae757b5 chore: bump cosign to v3.1.2, sign via Rekor v2 + TSA
• 615b279 feat(enterprise): serve detached Sigstore bundles for assets
• 5296d4a chore: update grpc library
• dee1a57 feat: support JWT download tokens
• c2339ee feat: support public routes in enterprise plugins
• a81f6e9 feat: proxy images through backing registry
• 32a3b08 fix: reuse registry puller for bundle verification

Changes from siderolabs/siderolink

4 commits

• ad296ab chore: rekres, bump deps
• 23030b0 fix: keep a replacement gRPC stream's send queue after cleanup
• 4b69f46 fix: correct the wireguard device error handling
• 5157d0c fix: accept valid short IPv6 packets on filtered devices

Dependency Changes

• github.com/aws/aws-sdk-go-v2 v1.43.2 -> v1.44.0
• github.com/aws/aws-sdk-go-v2/config v1.32.33 -> v1.32.40
• github.com/aws/aws-sdk-go-v2/credentials v1.19.32 -> v1.19.39
• github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.7 -> v0.3.17
• github.com/aws/aws-sdk-go-v2/service/s3 v1.106.2 -> v1.108.0
• github.com/aws/smithy-go v1.27.6 -> v1.28.1
• github.com/google/cel-go v0.31.0 new
• github.com/google/go-containerregistry v0.21.8 -> v0.22.0
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 -> v2.30.0
• github.com/russellhaering/goxmldsig v1.6.0 -> v1.6.1
• github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 -> v6.0.3
• github.com/siderolabs/image-factory v1.4.0 -> v1.6.0
• github.com/siderolabs/siderolink v0.3.16 -> v0.3.17
• github.com/siderolabs/talos/pkg/machinery v1.14.0-beta.1 -> 322de8bf2974
• github.com/sirupsen/logrus v1.9.4 -> v1.10.2
• github.com/stretchr/testify v1.11.1 -> v1.12.1
• github.com/zitadel/oidc/v3 v3.48.1 -> v3.49.3
• go.yaml.in/yaml/v4 v4.0.0-rc.6 -> 643e93b9c9be
• golang.org/x/crypto v0.54.0 -> v0.55.0
• golang.org/x/net v0.57.0 -> v0.58.0
• golang.org/x/text v0.40.0 -> v0.41.0
• golang.org/x/tools v0.48.0 -> v0.49.0
• google.golang.org/grpc v1.83.0 -> v1.83.2
• google.golang.org/protobuf f2248ac996af -> v1.36.12
• k8s.io/api v0.36.3 -> v0.37.0
• k8s.io/apimachinery v0.36.3 -> v0.37.0
• k8s.io/client-go v0.36.3 -> v0.37.0

Previous release can be found at v1.10.0

---

This discussion was created from the release v1.11.0-beta.0.