v1.15.0-alpha.0

[majabojarska]

Talos 1.15.0-alpha.0 (2026-09-08)

Welcome to the v1.15.0-alpha.0 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

containerd only migrates configuration from older versions, so any custom CRI configuration provided via
CRICustomizationConfig documents (or shipped by system extensions) is now interpreted as version 4, and settings
which moved in version 4 are silently ignored (only a Ignoring unknown key in TOML warning is logged by containerd).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

version 3	version 4
[metrics] address	[plugins."io.containerd.server.v1.metrics"] address
[metrics] grpc_histogram	[plugins."io.containerd.metrics.v1.grpc-prometheus"] grpc_histogram
[grpc] address, uid, gid, max_recv_message_size, max_send_message_size	[plugins."io.containerd.server.v1.grpc"] (same keys)
[grpc] tcp_address, tcp_tls_ca, tcp_tls_cert, tcp_tls_key, tcp_tls_common_name	[plugins."io.containerd.server.v1.grpc-tcp"] address, tls_ca, tls_cert, tls_key, tls_common_name
[ttrpc] address, uid, gid	[plugins."io.containerd.server.v1.ttrpc"] (same keys)
[debug] address, uid, gid	[plugins."io.containerd.server.v1.debug"] (same keys)

For example, the containerd metrics customization documented for previous versions of Talos:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [metrics]
    address = "0.0.0.0:11234"

should now be written as:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [plugins."io.containerd.server.v1.metrics"]
    address = "0.0.0.0:11234"

Note that [debug] level, format and log_trace_id stay at the top level, and that the ttrpc address is no longer
derived from the grpc address: if the grpc address is customized, the ttrpc plugin address has to be set explicitly.

Unified --namespace Flag

talosctl containers, logs, stats and restart now select the containerd namespace through the same --namespace flag and vocabulary already used by talosctl image and talosctl debug: system (the default), cri for Kubernetes workloads, and taloscontainers for containers declared via a ContainerConfig document.

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

talosctl image list also supports --namespace taloscontainers, to inspect images pulled for ContainerConfig containers. talosctl debug does not support the taloscontainers namespace.

Disk Free

A new talosctl diskfree command (aliased to df) reports storage and inode usage for mounted volumes.

Extension Service Configuration

ExtensionServiceConfig is supported only for extension services whose service manifest explicitly declares a configuration dependency:

depends:
  - configuration: true

Using ExtensionServiceConfig with a service that does not declare this dependency is unsupported and has undefined startup behavior.
The service might start before its configuration is rendered, leaving config files or environment variables unavailable until a later service restart.
Extension authors must declare the dependency before documenting ExtensionServiceConfig support.

IPVS Support

Following Kubernetes deprecation of IPVS support (kube-proxy), Talos Linux now ships IPVS as kernel modules which are not loaded by default.

If you require IPVS support, you can enable it by loading the following kernel modules:

• ip_vs (core)
• ip_vs_rr, ip_vs_wrr, ip_vs_lc, ip_vs_sh or ip_vs_mh (scheduling algorithms)
• xt_ipvs (nftables/iptables match)

Kernel Log Extra Tags

The KmsgLogConfig document now supports an extraTags field which attaches additional key-value pairs
to every kernel log message sent to that destination:

apiVersion: v1alpha1
kind: KmsgLogConfig
name: apiSink
url: https://kmsglog.api/logs
extraTags:
  cluster: staging-west
  node: worker-1

Tags are scoped to the destination they are configured on, so different endpoints can receive different tags.
The keys facility, seq, clock, priority, msg, talos-time and talos-level are reserved and rejected,
as they are set by Talos itself.

KubeSpan Peer Endpoint Filters

KubeSpan now supports filtering the endpoints received from other peers via filters.peerEndpoints in the KubeSpanConfig document.

While filters.endpoints filters the addresses a node advertises to the whole cluster, filters.peerEndpoints filters the endpoints
received from other peers before the node connects to them, affecting only that node. This allows excluding peer-advertised endpoints
which are known to be unreachable from a node (e.g., addresses of a private network the node is not connected to), so that KubeSpan
endpoint rotation never attempts them.

Secure Boot images no longer have lockdown=confidentiality enabled by default

Secure Boot images no longer have lockdown=confidentiality enabled by default.
This change was made to improve compatibility with eBPF tooling under default schematic.
This means that Secure Boot images will now have lockdown=integrity enabled by default (implicitly), which is the recommended setting for most users.
Users can override it by adding lockdown=confidentiality to the kernel command line through Image Factory if they require it.

MACVLAN Links

Talos Linux now supports creating MACVLAN links with a new MacVLANConfig document:

apiVersion: v1alpha1
kind: MacVLANConfig
name: eth0.macvlan
parent: eth0
mode: bridge # optional, defaults to `bridge`
addresses:
  - address: 192.168.1.100/24

The source mode is not supported yet, as it requires a list of allowed source MAC addresses.

Multipath Configuration

The multipath-tools system extension now reads /etc/multipath.conf from the Talos host instead of using ExtensionServiceConfig.
The multipathd service waits for this file and bind-mounts it read-only into its service container.

Before updating the extension, apply a machine config patch that deletes the existing ExtensionServiceConfig document and adds an EtcFileConfig document:

apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: multipathd
$patch: delete
---
apiVersion: v1alpha1
kind: EtcFileConfig
name: multipath.conf
mode: 0o644
contents: |
  defaults {
      user_friendly_names yes
      find_multipaths no
      path_selector "round-robin 0"
  }

The extension does not provide a default configuration, so multipathd remains waiting until /etc/multipath.conf is present.

Component Updates

Linux: 6.18.49
Kubernetes: 1.37.0
containerd: 2.3.5
CoreDNS: 1.14.7

Talos is built with Go 1.26.8.

VXLAN Links

Talos Linux now supports creating VXLAN links with a new VXLANConfig document:

apiVersion: v1alpha1
kind: VXLANConfig
name: vxlan100
id: 100 # VXLAN network identifier (VNI)
parent: eth0
local: 10.255.0.1 # or `group:` for a multicast group, but not both
port: 4789 # optional, defaults to 4789
learning: false # optional, defaults to true
addresses:
  - address: 192.168.1.100/24

Contributors

• Andrey Smirnov
• Maja Bojarska
• Noel Georgi
• Mateusz Urbanek
• Dmitrii Sharshakov
• Utku Ozdemir
• Loki San
• Max Makarov
• Sacha Weatherstone
• Dennis Docter
• Dima Aratin
• Evan Champion
• Ivan Demchuk
• Kamil Szczygieł
• Kuzia
• Licia Seiker
• MsfPablo
• Noel
• Orzelius
• Oscar Wieman
• Raphaël DUCOM
• Spencer Smith
• Steve Francis
• Winter
• dadbravo
• neiltalap
• usman.malik_ext

Changes

120 commits

• 12dfb8e1a release(v1.15.0-alpha.0): prepare release
• f3017d31e fix: add missing extension test patches for nfs
• 67ae852a9 fix: wait for USB settle explicitly
• 274dc8581 fix(security): define the permissions the 6.18 kernel expects in the classes
• 28841f4c4 fix: empty searchdomains dropped on merge
• 5a67d1e8e chore: support correctly various disk types for the system disk
• 834ba888a fix: improve resilience of the action tracker against dropped conns
• a2d35a90c fix: notify about link alias changes
• 9de219cfb test: nvidia - switch to nri
• 24ef6f436 fix: use the final config version in upgrade-k8s
• a1ec9d567 docs: update CODE_OF_CONDUCT.md
• 6a8b836f2 fix: set TCP keealive and user timeout on apid proxied connections
• 607ee15c9 chore: use the host page cache for the QEMU cluster disks
• a6bde65fd feat: allow generating an ECDSA service account key in secrets bundles
• ecb012883 feat: update containerd to 2.3.5
• 54204560c feat: bump to containerd config version 4
• a42ea1d4a feat: add KubeSpan peer endpoint filters
• 0bd0cc8fc fix: ensure lockdown integrity in SecureBoot mode
• 7eb4e75c1 feat: add KmsgLogConfig extraTags support
• 01ebf95a0 feat: add VXLAN interface configuration support
• 019b5f432 feat: add macvlan interface configuration support
• f5dc088fd fix: correct the bug with overlay assets in ESP being dropped
• 465a691f7 feat: update Linux to 6.18.49
• 0666eed65 fix: harden the code around kubelet's client certificate handling
• 5a2dfd460 test: revert disabling PS/2 in QEMU
• 6b16225b6 fix: correct typos in talosctl output, comments and config example
• 5da7387c9 docs: fix containerconfig.dependson examples
• 9f2eb6fb4 test: relax OOM test conditions
• 9361ad0c1 fix: normalize image reference when passing to image verification flow
• 7fd43a419 fix: name diskSelector in UnattendedInstallConfig validation errors
• 7aeb7d4a8 test: isolate base OCI spec test in BGP CLOS runs
• 27ea73811 feat: add USB LAN78XX drivers to the rootfs
• d7d41b53d fix: filter out passed metadata in API proxying
• ba625bc5e fix: allow CSI volumes to be mounted with an SELinux context
• fc0a1f020 test: libvirtd extensions
• 6e1c0cd42 fix: filter the output in talosctl
• b1b173f59 fix: treat desired roles empty as error in Talos API access
• ed3a1e091 fix: handle Akamai/Linode metadata without IPv6
• 9c058f898 feat: talos containers run with imagegccontroller
• 9cba2783f fix: container mount rshared propagation
• 241d55f37 refactor: don't skip container tests in short mode
• 10e8fb449 fix: ctr machinedaccss allowed roles
• 86628c57e fix: validate received kubeconfig
• 083e7f923 fix: drop dead legacy registries init from worker generation
• a8c09fb73 fix: exclude scheduler config from apiserver config version
• b46c53e8f fix: keep the time sync boot timeout across a syncer restart
• a4707d403 test: skip filemap heap test under race detector
• 86bfa8c21 feat: bump kernel to 6.18.48
• 6ee461278 fix: escape output in the talosctl dashboard
• 1ee84b268 fix: use os.Root in the talosctl extract path
• d970ebca4 chore: speed up unit-tests
• d5f53edee fix: add checks for meta key in the API path
• 6b1d1845c feat: update COSI to 1.16.3
• bfb8dfcc4 feat: add host extension pre-shutdown hooks
• e434671d7 fix: preserve shared libs symlinks
• fd0eee43f fix: drop libssl from the rootfs
• f7065d3c2 fix: route creation churning every 100ms
• 6f7b08ab4 chore: reduce verbosity of the grype scan
• 4f7f5c2fa fix: drop gRPC client keepalive aggressive settings in the tracker
• 1b1905a07 chore: bump sigstore/rekor to v1.5.4
• ea5484ba2 chore: add SPD5118 driver to squashfs
• 770e5cdd6 fix: preserve special modes when extracting files
• 613463d64 feat: containers can connect to machined
• abff95d73 feat: bump kubernetes to 1.37.0
• ba2d9a773 refactor: log filter stays enabled on enter press
• 0179b80f5 fix: hostns etc mount
• 6dcde1d9e feat: impl. container mount controller
• 48fe469a8 fix: write the uploaded etcd snapshot atomically
• f25b4a3cc chore: update multipath notes
• 86d76b0df feat: support host extension services
• d70eb0078 feat: talos containers support for talosctl
• 4f56e5f44 fix: cache filemap layers on disk
• 1bb6e1f10 fix: skip selinux label for read-only/detached/external mounts
• 7ca297a11 feat: add xfrm interface module
• e489f9538 fix: capture packets correctly on VLANs
• e12769b1f test: update Image Factory Talos versions
• 17b631eb0 feat: update Linux to 6.18.46
• 00ec33789 fix: enable additional SELinux permissions for Cilium
• 9c747cb2e fix: use os.Root in the untar path
• f48e688bf docs: update CRI customization example
• 15c3d1a4b test: apid tls provider
• 8979ecefe feat: impl. container runtime controller
• 0ae93592b refactor: make runner.runner context-native
• 48e604d52 fix(talosctl): preserve uncompressed cached image layers
• 1205defbb fix: use default terminal theme colors in talosctl dashboard
• e8872ff71 fix: don't create new client in dry-run mode
• f61de6f44 fix: preserve selected sd-boot entry on upgrade
• ad8823176 feat: add a talosctl df command
• 78e378a48 fix: use the UKI command line when the config has no install section
• a469e965a fix: persist in-memory meta on fresh install
• a72281e5b fix: drop lockdown=confidentiality default for 1.14+
• f80fd0985 fix: reduce stalls in the etcd member promotion cycle
• 3b3e0e955 feat: update Go to 1.26.7
• 41c0c0a02 feat: update CoreDNS to 1.14.7
• 481f98d8c feat: update Kubernetes to 1.37.0-rc.1
• dcfb17c96 feat: implement support for primary setting for the BondConfig
• 63bd62c9c fix: watch IPv6 route changes in RouteSpecController
• b2693f08e feat: update Linux to 6.18.45
• 398d2be8d fix: enable SELinux to work with overlays
• df72d021f fix: move the spike information field of the time.Status resource
• 8b5f1097b chore: ensure nightlies only run in one region
• f7305d6f5 feat: impl ContainerInstanceController
• fdf0efa8b feat: log peer address in gRPC request log
• 013b9489e feat: talosctl dashboard log filtering
• 5fcf360fe fix: truncate files replaced by system extensions
• 4c575c207 fix: skip target settings for external volume mounts
• c685f2712 chore: update disvulncheck dates
• aaf35fbde fix: use v1.13 config to test downgrade failure
• 2b0316913 test: use tiny hostns debug image
• 42d72ed56 feat: move IPVS support into modules
• be6b96386 fix: support try mode apply without prior config
• 68876cc1e fix: adjust cluster size for VFAT on ISO
• 9cb5dc9b9 feat: update containerd to 2.3.4
• 32f7fc0df feat: impl ContainerImageController
• 5675ada21 test: add cachefilesd to the test matrix
• a1183478a fix: apply directory user volume mount security
• 55e0f6350 fix: install conntrack handler in accept ingress firewall mode
• 1c50b73fb fix: share IPC namespace with the host for extension services
• 6cda3e2e2 chore: prepare for Talos 1.15
• 8514d9963 fix: provide read-only random seed in the ISO

Changes from siderolabs/go-debug

1 commit

• siderolabs/go-debug@44d6398 feat: support Go 1.27

Changes from siderolabs/pkgs

25 commits

• siderolabs/pkgs@977b61f feat: update containerd to 2.3.5
• siderolabs/pkgs@43e6298 fix: add a kernel patch for EFI SecureBoot integrity lockdown
• siderolabs/pkgs@a8b682b feat: add kernel modules to enable Intel HD audio
• siderolabs/pkgs@ff111ff feat: enable Apple Silicon platform drivers
• siderolabs/pkgs@e68eeb5 feat: enable VIRTIO_INPUT as built-in for amd64/arm64
• siderolabs/pkgs@381fc2d feat: bump kernel to 6.18.49
• siderolabs/pkgs@5394321 feat: enable CONFIG_USB_LAN78XX and CONFIG_MICROCHIP_PHY on amd64
• siderolabs/pkgs@4b9bf36 fix: preserve symlinks for libudev
• siderolabs/pkgs@50bf09f fix: update OpenSSL to 3.6.4
• siderolabs/pkgs@f2b7acf feat: update kernel to 6.18.48
• siderolabs/pkgs@73327ff feat: bump kernel to 6.18.47
• siderolabs/pkgs@b6b2843 feat: enable CONFIG_XFRM_INTERFACE in the kernel
• siderolabs/pkgs@696fa3c feat: expose more software as pkgs
• siderolabs/pkgs@aa069d3 chore: update OpenZFS to 2.4.4
• siderolabs/pkgs@c1837b6 feat: bump kernel to 6.18.46
• siderolabs/pkgs@28f5f23 feat: enable SPD5118 sensor driver
• siderolabs/pkgs@bc45b69 feat: backport aes256k support (Ceph)
• siderolabs/pkgs@b914c26 feat: update Go to 1.26.7
• siderolabs/pkgs@caac515 feat: update Linux to 6.18.45
• siderolabs/pkgs@ada230a feat: enable IPSec offload and dma-buf heaps
• siderolabs/pkgs@33d14e0 feat(kernel): enable CONFIG_MLX5_VFIO_PCI
• siderolabs/pkgs@107b628 feat: kernel: enable MPTCP, sched_ext
• siderolabs/pkgs@c9173bb feat: move IPVS into modules
• siderolabs/pkgs@d418aa7 feat: update containerd to 2.3.4
• siderolabs/pkgs@c4a6a61 feat: update Go to 1.26.6

Changes from siderolabs/tools

6 commits

• siderolabs/tools@09ccc74 feat: bump go to 1.26.8
• siderolabs/tools@35fab51 fix: update OpenSSL to 3.6.4
• siderolabs/tools@e033f2a feat: move more packages into separate images
• siderolabs/tools@d102f15 feat: update Go to 1.26.7
• siderolabs/tools@fd531a3 feat: update Go to 1.26.6
• siderolabs/tools@5eabe31 chore: rekres 2026-08-12

Dependency Changes

• github.com/containerd/containerd/v2 v2.3.4 -> v2.3.5
• github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5
• github.com/siderolabs/go-debug v0.6.2 -> v0.6.3
• github.com/siderolabs/pkgs v1.14.0-15-g2f03590 -> v1.15.0-alpha.0-24-g977b61f
• github.com/siderolabs/talos/pkg/machinery v1.14.0 -> v1.15.0-alpha.0
• github.com/siderolabs/tools v1.14.0-5-g87316ca -> v1.15.0-alpha.0-5-g09ccc74

Previous release can be found at v1.14.0

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:3.7.1
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.0
registry.k8s.io/kube-controller-manager:v1.37.0
registry.k8s.io/kube-scheduler:v1.37.0
registry.k8s.io/kube-proxy:v1.37.0
ghcr.io/siderolabs/kubelet:v1.37.0
registry.k8s.io/networking/kube-network-policies:v1.1.1
ghcr.io/siderolabs/installer-base:v1.15.0-alpha.0
ghcr.io/siderolabs/imager:v1.15.0-alpha.0
ghcr.io/siderolabs/talos:v1.15.0-alpha.0
ghcr.io/siderolabs/talosctl-all:v1.15.0-alpha.0
ghcr.io/siderolabs/overlays:v1.15.0-alpha.0
ghcr.io/siderolabs/extensions:v1.15.0-alpha.0

---

This discussion was created from the release v1.15.0-alpha.0.