You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Release Date | 2023-08-15, TBD | 2023-04-18 (1.4.0) |
10
-
| End of Community Support | 1.6.0 release (2023-12-15, TBD) | 1.5.0 release (2023-08-15, TBD) |
9
+
| Release Date | 2023-08-17, TBD | 2023-04-18 (1.4.0) |
10
+
| End of Community Support | 1.6.0 release (2023-12-15, TBD) | 1.5.0 release (2023-08-17, TBD) |
11
11
| Enterprise Support |[offered by Sidero Labs Inc.](https://www.siderolabs.com/support/)|[offered by Sidero Labs Inc.](https://www.siderolabs.com/support/)|
| - SBCs | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Nano Pi R4S, Pine64, Pine64 Rock64, Radxa ROCK Pi 4c, Raspberry Pi 4B, Raspberry Pi Compute Module 4 | Banana Pi M64, Jetson Nano, Libre Computer Board ALL-H3-CC, Nano Pi R4S, Pine64, Pine64 Rock64, Radxa ROCK Pi 4c, Raspberry Pi 4B, Raspberry Pi Compute Module 4 |
Copy file name to clipboardExpand all lines: website/content/v1.5/introduction/what-is-new/index.md
+161-1Lines changed: 161 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,4 +6,164 @@ description: "List of new and shiny features in Talos Linux."
6
6
7
7
See also [upgrade notes]({{< relref "../../talos-guides/upgrading-talos/">}}) for important changes.
8
8
9
-
TBD
9
+
## Predictable Network Interface Names
10
+
11
+
Starting with version Talos 1.5, network interfaces are renamed to [predictable names](https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/)
12
+
same way as `systemd` does that in other Linux distributions.
13
+
14
+
The naming schema `enx78e7d1ea46da` (based on MAC addresses) is enabled by default, the order of interface naming decisions is:
15
+
16
+
* firmware/BIOS provided index numbers for on-board devices (example: `eno1`)
* physical/geographical location of the connector of the hardware (example: `enp2s0`)
19
+
* interfaces's MAC address (example: `enx78e7d1ea46da`)
20
+
21
+
The predictable network interface names features can be disabled by specifying `net.ifnames=0` in the kernel command line.
22
+
Talos automatically adds the `net.ifnames=0` kernel argument when upgrading from Talos versions before 1.5, so upgrades to 1.5 don't require any manual intervention.
23
+
24
+
This change doesn't affect "cloud" platforms, like AWS, as Talos automatically adds `net.ifnames=0` to the kernel command line.
25
+
26
+
## SecureBoot
27
+
28
+
Talos now supports booting on UEFI systems in [SecureBoot]({{< relref "../../talos-guides/install/bare-metal-platforms/secureboot" >}}) mode.
29
+
When combined with TPM-based disk encryption, this provides Trusted Boot experience.
30
+
31
+
## Boot Assets Generation
32
+
33
+
Talos provides [a new unified way]({{< relref "../../talos-guides/install/boot-assets" >}}) to generate various boot assets, including ISOs, disk images, PXE boot files, installer container images etc., which can be
34
+
further customized with system extensions, extra kernel arguments.
35
+
36
+
## Kubernetes
37
+
38
+
### KubePrism - Kubernetes API Server In-Cluster Load Balancer
39
+
40
+
Talos now supports configuring the [KubePrism]({{< relref "../../kubernetes-guides/configuration/kubeprism">}}) - Kubernetes API Server in-cluster load balancer with machine config
41
+
`features.kubePrism.port` and `features.kubePrism.enabled` fields.
42
+
43
+
If enabled, KubePrism binds to `localhost` and runs on the same port on every machine in the cluster.
44
+
The default value for KubePrism endpoint is https://localhost:7445.
45
+
46
+
The KubePrism is used by the `kubelet`, `kube-scheduler`, `kube-controller-manager`
47
+
and `kube-proxy` by default and can be passed to the CNIs like Cilium and Calico.
48
+
49
+
The KubePrism provides access to the Kubernetes API endpoint even if the external loadbalancer
50
+
is not healthy, provided that the worker nodes can reach to the controlplane machine addresses directly.
51
+
52
+
### XFS Quota
53
+
54
+
Talos 1.5+ enables XFS project quota support by default, also enabling by default
55
+
kubelet feature gate `LocalStorageCapacityIsolationFSQuotaMonitoring` to use xfs quotas
56
+
to monitor volume usage instead of `du`.
57
+
58
+
This feature is controlled by the `.machine.features.diskQuotaSupport` field in the machine config,
59
+
it is set to true for new clusters.
60
+
61
+
When upgrading from a previous version, the feature can be enabled by setting the field to true.
62
+
On the first mount of a volume, the quota information will be recalculated, which may take some time.
63
+
64
+
## System Extensions
65
+
66
+
### Installing System Extensions
67
+
68
+
The way to install system extensions on the machine using `machine.install.extensions` machine configuration option is now deprecated,
69
+
please use instead [the boot asset generation process]({{< relref "../../talos-guides/install/boot-assets" >}}) to create an image with system extension pre-installed.
70
+
71
+
### Extension Services
72
+
73
+
Talos now supports setting `environmentFile` for an [extension service container spec]({{< relref "../../advanced/extension-services/#container" >}}).
74
+
The extension waits for the file to be present before starting the service.
75
+
76
+
## Disk Encryption
77
+
78
+
### TPM-based Disk Encryption
79
+
80
+
Talos now supports encrypting `STATE`/`EPHEMERAL` with [keys bound to a TPM device]{{< relref "../../talos-guides/install/bare-metal-platforms/secureboot" >}}().
81
+
The TPM device must be TPM2.0 compatible.
82
+
This type of disk encryption should be used when booting Talos in SecureBoot mode.
83
+
84
+
Example machine config:
85
+
86
+
```yaml
87
+
machine:
88
+
systemDiskEncryption:
89
+
ephemeral:
90
+
provider: luks2
91
+
keys:
92
+
- slot: 0
93
+
tpm: {}
94
+
state:
95
+
provider: luks2
96
+
keys:
97
+
- slot: 0
98
+
tpm: {}
99
+
```
100
+
101
+
### Network KMS Disk Encryption
102
+
103
+
Talos now supports new type of encryption keys which are sealed/unsealed with an external KMS server:
104
+
105
+
```yaml
106
+
machine:
107
+
systemDiskEncryption:
108
+
ephemeral:
109
+
provider: luks2
110
+
keys:
111
+
- kms:
112
+
endpoint: https://1.2.3.4:443
113
+
slot: 0
114
+
```
115
+
116
+
gRPC API definitions and a simple reference implementation of the KMS server can be found in this
Kubernetes pods running in CNI mode can use the `kubernetes.default.svc` service endpoint to access the Kubernetes API server,
7
+
while pods running in host networking mode can only use the external cluster endpoint to access the Kubernetes API server.
8
+
9
+
Kubernetes controlplane components run in host networking mode, and it is critical for them to be able to access the Kubernetes API server,
10
+
same as CNI components (when CNI requires access to Kubernetes API).
11
+
12
+
The external cluster endpoint might be unavailable due to misconfiguration or network issues, or it might have higher latency than the internal endpoint.
13
+
A failure to access the Kubernetes API server might cause a series of issues in the cluster: pods are not scheduled, service IPs stop working, etc.
14
+
15
+
KubePrism feature solves this problem by enabling in-cluster highly-available controlplane endpoint on every node in the cluster.
16
+
17
+
## Enabling KubePrism
18
+
19
+
> As of Talos 1.5, KubePrism is not enabled by default.
20
+
21
+
To enable KubePrism, apply the following machine config patch either during the machine config generation, or to a running cluster (the patch should be applied to all nodes):
22
+
23
+
```yaml
24
+
machine:
25
+
features:
26
+
kubeprism:
27
+
enabled: true
28
+
port: 7445
29
+
```
30
+
31
+
> Note: the `port` specified should be available on every node in the cluster.
32
+
33
+
## How it works
34
+
35
+
Talos spins up a TCP loadbalancer on every machine on the `localhost` on the specified port which automatically picks up one of the endpoints:
36
+
37
+
* the external cluster endpoint as specified in the machine configuration
38
+
* for controlplane machines: `https://localhost:<api-server-local-port>` (`http://localhost:6443` in the default configuration)
39
+
* `https://<controlplane-address>:<api-server-port>` for every controlplane machine (based on the information from [Cluster Discovery]({{< relref "../../talos-guides/discovery" >}}))
40
+
41
+
KubePrism automatically filters out unhealthy (or unreachable) endpoints, and prefers lower-latency endpoints over higher-latency endpoints.
42
+
43
+
Talos automatically reconfigures `kubelet`, `kube-scheduler` and `kube-controller-manager` to use the KubePrism endpoint.
44
+
The `kube-proxy` manifest is also reconfigured to use the KubePrism endpoint by default, but when enabling KubePrism for a running cluster the manifest should be updated
45
+
with `talosctl upgrade-k8s` command.
46
+
47
+
When using CNI components that require access to the Kubernetes API server, the KubePrism endpoint should be passed to the CNI configuration (e.g. Cilium, Calico CNIs).
48
+
49
+
## Notes
50
+
51
+
As the list of endpoints for KubePrism includes the external cluster endpoint, KubePrism in the worst case scenario will behave the same as the external cluster endpoint.
52
+
For controlplane nodes, the KubePrism should pick up the `localhost` endpoint of the `kube-apiserver`, minimizing the latency.
53
+
Worker nodes might use direct address of the controlplane endpoint if the latency is lower than the latency of the external cluster endpoint.
54
+
55
+
KubePrism listen endpoint is bound to `localhost` address, so it can't be used outside the cluster.
0 commit comments