v1.15.0-alpha.1

[shanduur]

Talos 1.15.0-alpha.1 (2026-10-13)

Welcome to the v1.15.0-alpha.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Boot Partition Wait

Talos now waits for the partition it was booted from to be discovered before declaring the system volumes (META, STATE) missing
and entering maintenance mode, so that disks enumerated late (SD cards, USB, some RAID controllers) are not mistaken for a fresh machine.

On UEFI systems booted via systemd-boot the boot partition comes from the LoaderDevicePartUUID EFI variable, while the GRUB configuration
now passes the talos.boot.partuuid=<UUID> kernel argument (probed by GRUB at boot). The detected boot partition is published as the bootpartition resource.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

containerd only migrates configuration from older versions, so any custom CRI configuration provided via
CRICustomizationConfig documents (or shipped by system extensions) is now interpreted as version 4, and settings
which moved in version 4 are silently ignored (only a Ignoring unknown key in TOML warning is logged by containerd).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

version 3	version 4
[metrics] address	[plugins."io.containerd.server.v1.metrics"] address
[metrics] grpc_histogram	[plugins."io.containerd.metrics.v1.grpc-prometheus"] grpc_histogram
[grpc] address, uid, gid, max_recv_message_size, max_send_message_size	[plugins."io.containerd.server.v1.grpc"] (same keys)
[grpc] tcp_address, tcp_tls_ca, tcp_tls_cert, tcp_tls_key, tcp_tls_common_name	[plugins."io.containerd.server.v1.grpc-tcp"] address, tls_ca, tls_cert, tls_key, tls_common_name
[ttrpc] address, uid, gid	[plugins."io.containerd.server.v1.ttrpc"] (same keys)
[debug] address, uid, gid	[plugins."io.containerd.server.v1.debug"] (same keys)

For example, the containerd metrics customization documented for previous versions of Talos:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [metrics]
    address = "0.0.0.0:11234"

should now be written as:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [plugins."io.containerd.server.v1.metrics"]
    address = "0.0.0.0:11234"

Note that [debug] level, format and log_trace_id stay at the top level, and that the ttrpc address is no longer
derived from the grpc address: if the grpc address is customized, the ttrpc plugin address has to be set explicitly.

Unified --namespace Flag

talosctl containers, logs, stats and restart now select the containerd namespace through the same --namespace flag and vocabulary already used by talosctl image and talosctl debug: system (the default), cri for Kubernetes workloads, and taloscontainers for containers declared via a ContainerConfig document.

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

talosctl image list also supports --namespace taloscontainers, to inspect images pulled for ContainerConfig containers. talosctl debug does not support the taloscontainers namespace.

CPU Scaling Configuration

CPU frequency scaling can now be configured declaratively with the CPUScalingConfig document, instead of through kernel arguments
or raw SysfsConfig keys:

apiVersion: v1alpha1
kind: CPUScalingConfig
name: all-cores
selector:
  match: true
governor: performance

Settings apply to the cpufreq policies matched by the selector, which targets cores by property rather than by index, so a machine
whose cores are not uniform can be configured without hardcoding how many it has:

apiVersion: v1alpha1
kind: CPUScalingConfig
name: performance-cores
selector:
  match: cpu.core_type == "performance"
governor: performance
---
apiVersion: v1alpha1
kind: CPUScalingConfig
name: efficiency-cores
selector:
  match: cpu.core_type == "efficiency"
governor: powersave

The selector matches against the fields of the CPUScalingStatus resource, and may also set energyPerformancePreference,
minFrequencyKhz and maxFrequencyKhz. Where several documents match the same policy, the one whose name sorts first wins, and the
document which claimed a policy is reported on the resulting CPUScalingSpec resource. Removing the configuration restores the
values the machine booted with.

Setting a cpufreq attribute through both CPUScalingConfig and SysfsConfig is rejected, as the two would otherwise overwrite each
other continuously.

Disk SMART Status

Talos can now collect SMART (Self-Monitoring, Analysis and Reporting Technology) health information from disks,
exposed via the new SMARTStatus resource (one per disk, keyed by the disk device name).

Collection is controlled by the presence of the new DiskSMARTConfig document: while the document is part of
the machine configuration SMART status is collected, and removing the document disables collection (any
SMARTStatus resources already produced are removed as well). There is no enabled field.

apiVersion: v1alpha1
kind: DiskSMARTConfig
interval: 30m0s

talosctl gen config and talosctl cluster create emit this document by default, so SMART status collection
is enabled by default for machine configurations generated by Talos 1.15. Clusters upgraded from an earlier
version keep their existing machine configuration, which carries no DiskSMARTConfig document, so SMART
status collection stays off there until the document is added.

Rotational disks are never spun up just to be probed: a disk in standby is detected via ATA
CHECK POWER MODE and its SMART data is left untouched until it is active again.

To retrieve SMART statuses:

talosctl get smart

The resource reports an overall health verdict, temperature, power-on hours and power cycles, NVMe wear
indicators (percent used, available spare, critical warning, media errors) and, for ATA/SATA disks, the raw
SMART attribute table with per-attribute thresholds.

Disk Free

A new talosctl diskfree command (aliased to df) reports storage and inode usage for mounted volumes.

Extension Service Configuration

ExtensionServiceConfig is supported only for extension services whose service manifest explicitly declares a configuration dependency:

depends:
  - configuration: true

Using ExtensionServiceConfig with a service that does not declare this dependency is unsupported and has undefined startup behavior.
The service might start before its configuration is rendered, leaving config files or environment variables unavailable until a later service restart.
Extension authors must declare the dependency before documenting ExtensionServiceConfig support.

talosctl gen removed subcommands

The following talosctl gen subcommands have been removed:

• talosctl gen ca
• talosctl gen crt
• talosctl gen csr
• talosctl gen key
• talosctl gen keypair

These commands where historically used to generate pieces of Talos PKI, but they are no longer needed
as talosctl gen config and talosctl gen secrets now generate all required PKI material automatically.

Blank Virtual Machine Disks

A virtual machine disk can now be provisioned as an empty volume in a storage pool, rather than only
as a CD-ROM attached from a content library:

apiVersion: v1alpha1
kind: VirtualMachineConfig
name: vm1
disks:
  - name: data
    pool: pool1
    size: 100GiB
    format: qcow2
    provision:
      blank: {}

The pool must be declared by a StoragePool document in the same machine configuration; a disk
naming an undeclared pool is now a configuration error rather than a virtual machine that silently
never starts.

Four behaviours are worth knowing before you rely on this:

• Volumes are adopted by name and are never deleted. The volume is named after the virtual
  machine and the disk, so removing the disk from the configuration leaves the data in place, and
  re-declaring the same virtual machine and disk names in the same pool reattaches it. Reclaiming
  the space is a deliberate, out-of-band act. talosctl get storagepoolvolumestatuses lists
  managed volumes, not retained orphan files: their statuses disappear when their requests and
  consumers are gone. Inspect the pool's backing directory to discover retained files before
  reclaiming space; confirm a file is no longer in use before deleting it.
• Disks grow only. Raising size grows the volume the next time no virtual machine has it open,
  because growing one underneath a running guest corrupts qcow2 metadata and is invisible to the
  guest for raw. The pending growth is reported on the volume's status.
• A smaller size is reported and ignored. Shrinking would truncate a filesystem the guest laid
  out, so it is refused rather than applied; the disk stays attachable and the virtual machine keeps
  running.
• Remove all virtual machine references together with a StoragePool document. Removing a
  referenced pool alone is rejected by configuration validation. Remove or update every virtual
  machine referencing it in the same configuration change. During teardown, consumers release
  the pool before it is undefined and its backing directory can be unmounted. The volume files
  survive.

Provisioning a disk from a content library image is not implemented yet; provision.fromImage is
still only supported on a cdrom.

Ignore Ctrl-Alt-Delete

Setting ignoreCtrlAltDelete: true in the SecurityProfileConfig document makes Talos log and ignore Ctrl-Alt-Delete instead of rebooting the machine.
Ctrl-Alt-Delete still reboots the machine until a configuration with this option is applied.

IPVS Support

Following Kubernetes deprecation of IPVS support (kube-proxy), Talos Linux now ships IPVS as kernel modules which are not loaded by default.

If you require IPVS support, you can enable it by loading the following kernel modules:

• ip_vs (core)
• ip_vs_rr, ip_vs_wrr, ip_vs_lc, ip_vs_sh or ip_vs_mh (scheduling algorithms)
• xt_ipvs (nftables/iptables match)

Kernel Log Extra Tags

The KmsgLogConfig document now supports an extraTags field which attaches additional key-value pairs
to every kernel log message sent to that destination:

apiVersion: v1alpha1
kind: KmsgLogConfig
name: apiSink
url: https://kmsglog.api/logs
extraTags:
  cluster: staging-west
  node: worker-1

Tags are scoped to the destination they are configured on, so different endpoints can receive different tags.
The keys facility, seq, clock, priority, msg, talos-time and talos-level are reserved and rejected,
as they are set by Talos itself.

Kubelet Image GC Thresholds

Talos now defaults kubelet imageGCHighThresholdPercent to 75 and imageGCLowThresholdPercent to 65 (upstream defaults are 85 and 80).

The upstream image GC high threshold matches the default imagefs.available<15% hard eviction threshold, so the node was put
into DiskPressure (and tainted for evictionPressureTransitionPeriod) before image GC had a chance to run.

The defaults are applied only if neither of the thresholds is set in machine.kubelet.extraConfig.
On upgrade, nodes with disk usage above 75% will garbage collect unused images.

Kubelet Resource Manager State

Talos now validates the kubelet CPU manager and memory manager state files (/var/lib/kubelet/cpu_manager_state, /var/lib/kubelet/memory_manager_state)
the same way kubelet does on startup, and removes a state file kubelet would refuse to load before starting kubelet.

Previously only a change of the manager policy was detected, so changing e.g. reservedSystemCPUs or reservedMemory, or
a change of the CPU/NUMA topology of the machine, left kubelet unable to start until the state file was removed manually.

Only the rendered KubeletConfiguration (machine.kubelet.extraConfig) is checked: the resource manager settings passed as kubelet
command line flags via machine.kubelet.extraArgs (e.g. --cpu-manager-policy, --reserved-cpus) are not taken into account.

KubeSpan Peer Endpoint Filters

KubeSpan now supports filtering the endpoints received from other peers via filters.peerEndpoints in the KubeSpanConfig document.

While filters.endpoints filters the addresses a node advertises to the whole cluster, filters.peerEndpoints filters the endpoints
received from other peers before the node connects to them, affecting only that node. This allows excluding peer-advertised endpoints
which are known to be unreachable from a node (e.g., addresses of a private network the node is not connected to), so that KubeSpan
endpoint rotation never attempts them.

LLDP Neighbor Discovery

Talos now listens for LLDP on physical Ethernet interfaces and reports neighbors through the LLDPNeighborStatus resource.
Reported information includes chassis and port IDs, system and port descriptions, system names, management addresses, and VLANs.
The built-in listener does not transmit advertisements; use the lldpd system extension when advertising is required.

Secure Boot images no longer have lockdown=confidentiality enabled by default

Secure Boot images no longer have lockdown=confidentiality enabled by default.
This change was made to improve compatibility with eBPF tooling under default schematic.
This means that Secure Boot images will now have lockdown=integrity enabled by default (implicitly), which is the recommended setting for most users.
Users can override it by adding lockdown=confidentiality to the kernel command line through Image Factory if they require it.

MACVLAN Links

Talos Linux now supports creating MACVLAN links with a new MacVLANConfig document:

apiVersion: v1alpha1
kind: MacVLANConfig
name: eth0.macvlan
parent: eth0
mode: bridge # optional, defaults to `bridge`
addresses:
  - address: 192.168.1.100/24

The source mode is not supported yet, as it requires a list of allowed source MAC addresses.

Multipath Configuration

The multipath-tools system extension now reads /etc/multipath.conf from the Talos host instead of using ExtensionServiceConfig.
The multipathd service waits for this file and bind-mounts it read-only into its service container.

Before updating the extension, apply a machine config patch that deletes the existing ExtensionServiceConfig document and adds an EtcFileConfig document:

apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: multipathd
$patch: delete
---
apiVersion: v1alpha1
kind: EtcFileConfig
name: multipath.conf
mode: 0o644
contents: |
  defaults {
      user_friendly_names yes
      find_multipaths no
      path_selector "round-robin 0"
  }

The extension does not provide a default configuration, so multipathd remains waiting until /etc/multipath.conf is present.

NFS External Volumes

Talos now supports NFS as an ExternalVolumeConfig filesystem type alongside virtiofs, allowing nodes to mount network exports at /var/mnt/<name> through the existing block volume machinery.

apiVersion: v1alpha1
kind: ExternalVolumeConfig
name: shared
filesystemType: nfs
mount:
  nfs:
    server: 10.0.0.10
    path: /export
    version: "4.1"

Supported version values are 3, 4, 4.1, and 4.2.
The mount.nfs spec configures the kernel NFS client:

• Connectivity: server (hostname or IP; IPv6 is bracketed automatically) and absolute path are required; optional port, transport (tcp/udp), and NFSv3-only mountPort/mountTransport (otherwise rpcbind discovery is used).
• NFSv3 locking: locking (local default / remote) controls nolock/lock; Talos does not run rpc.statd, so local (nolock) is the safe default. You need rpc.statd extension for remote locking.
• Recovery: recovery (hard/soft/soft-error) maps to hard/soft/softerr.
• Tuning: timeout (timeo, deciseconds), retransmissions (retrans), readSize/writeSize (rsize/wsize, 1024–1048576 multiples of 1024), connections (nconnect, 1–16, TCP only), reservedPort (resvport/noresvport), and security (none/sys; Kerberos flavors are unsupported as Talos does not run rpc.gssd).
• NFSv4 enforces tcp transport.

Common mount flags (readOnly, disableAccessTime, secure) apply as with other volume types.
Validation rejects mountPort/mountTransport/locking outside NFSv3 and udp for NFSv4.

NUMA Topology and VM Placement Validation

Talos reports host NUMA nodes, CPU membership and total node memory through the NUMATopology resource.
Explicit VM CPU pins and memory-node selections are checked against the host before starting or replacing a guest.
Invalid placement leaves an existing guest running; CPUs and guest memory may intentionally use different nodes.
This validates placement, not available memory capacity or reservations. Host inventory is not exposed in container mode.

Route Updates

RouteSpec resource IDs now match the key the Linux kernel uses for routes: routing table, address family, destination and priority (metric),
e.g. inet4/10.0.0.0/8/1024 instead of inet4/10.0.0.1/10.0.0.0/8/1024.
The gateway, the output link and the multipath next-hops are no longer part of the ID, so changing them updates the route in place
(RTM_NEWROUTE with NLM_F_REPLACE) without the route ever being missing, e.g. when a BGP route switches between a single next-hop and ECMP.

Routes which differ only in the next-hops (which can't be installed into the kernel at the same time) are now merged into a single route,
with the higher configuration layer taking precedence.
RouteStatus resource IDs are not changed.

Permissions of the Generated Files

talosctl now writes every file which might contain secrets with 0600 permissions (owner read/write only),
and it restricts the permissions of the files it overwrites as well.

This affects the machine configuration (talosctl gen config, talosctl machineconfig patch,
talosctl cluster create --skip-injecting-config), talosconfig and kubeconfig.

Time Check API

The TimeService/TimeCheck API (talosctl time --check) is no longer available to the os:reader role, as it allows querying
arbitrary time servers from the node. The TimeService/Time API (querying the configured time server) is still available to os:reader.

PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under /dev,
the name should start with ptp (e.g. /dev/ptp0, /dev/ptp_kvm), and the device should be a PTP character device.

Filesystem Trim Chunking

The FilesystemTrimConfig document (and the per-volume trim settings) now support chunkSize, chunkDelay and minLength options.

By default, the whole filesystem is trimmed at once (same as the fstrim command), which issues discards for all free space back-to-back
and might cause latency spikes for other workloads on the same disk (e.g. etcd).
Setting chunkSize splits the trim into multiple operations with chunkDelay in between, while minLength skips free ranges smaller than the specified size.

Component Updates

Linux: 6.18.55
Kubernetes: 1.38.0-alpha.2
containerd: 2.3.6
runc: 1.5.2
CoreDNS: 1.14.7
systemd-udevd: 262

Talos is built with Go 1.27.2.

Virtual Machine Serial Console

Talos-managed virtual machines now expose their serial console over the Talos API, with no host shell access required.

talosctl hypervisor console <vm-name> attaches to the live serial console of a running VM.
Press Ctrl-] to detach without stopping the VM; Ctrl-C is forwarded to the guest.
Only one session can be attached to a VM at a time, and previous output is not replayed.
The command is supported on Unix clients only.

Serial output is also persisted on the host (with bounded retention), and can be read with talosctl logs --kind=vm <vm-name>,
including --tail and --follow. The new --kind flag (container, vm or service) selects the log source explicitly;
omitting it keeps the previous service/container routing.

Both the console and the VM logs require the os:admin role and a single target node.

Virtual Machine VNC Console

The new talosctl hypervisor vnc <vm-name> command forwards a virtual machine's graphical console to a local loopback TCP port.
Enable console.vnc.enabled in its VirtualMachineConfig; access requires the os:admin role and exactly one target node.

The listener accepts one viewer at a time and supports reconnecting without restarting the command.
Use a viewer that supports unauthenticated RFB.
Talos authenticates the tunnel, and no VNC TCP port is opened on the node.

VXLAN Links

Talos Linux now supports creating VXLAN links with a new VXLANConfig document:

apiVersion: v1alpha1
kind: VXLANConfig
name: vxlan100
id: 100 # VXLAN network identifier (VNI)
parent: eth0
local: 10.255.0.1 # or `group:` for a multicast group, but not both
port: 4789 # optional, defaults to 4789
learning: false # optional, defaults to true
addresses:
  - address: 192.168.1.100/24

Workload Memory Limits

The new WorkloadResourceConfig document sets independent aggregate memory limits for Kubernetes pods, Talos containers and virtual machines:

apiVersion: v1alpha1
kind: WorkloadResourceConfig
kubepods:
  memory:
    limit: 16GiB
taloscontainers:
  memory:
    limit: 4GiB
virtualMachines:
  memory:
    limit: 32GiB

Each root is optional. Limits are ceilings, not reservations, and do not cover swap or HugeTLB memory.
For kubepods, Talos derives systemReserved.memory so kubelet enforces the cap and adjusts Node Allocatable;
an explicit systemReserved.memory, conflicting kubelet flags or the Static memory manager cannot be combined with this limit.
Changing the Kubernetes cap restarts kubelet. Without Kubernetes, only the container and virtual machine limits apply.

Lowering a limit can OOM-kill workloads in that group, including QEMU guests or Kubernetes control-plane pods.
Talos exclusively owns memory.max on /taloscontainers and /virtualmachines.partition, even without this document.
Omitting their limits means unlimited aggregate memory; individual child limits still apply.
Kubelet system-reserved or kube-reserved memory enforcement on these roots is rejected regardless of this document;
CPU-only or compressible enforcement and reservations on unrelated roots remain supported.
Kubelet drop-in directories are rejected while any cap is active; without caps, their contents remain the operator's responsibility.
Removing the Kubernetes cap restores the original kubelet configuration. The document has no effect in container mode.

Contributors

• Andrey Smirnov
• Maja Bojarska
• Noel Georgi
• Mateusz Urbanek
• Utku Ozdemir
• Dmitrii Sharshakov
• Justin Garrison
• Orzelius
• Loki San
• Max Makarov
• Oscar Wieman
• immanuwell
• Jarrad S
• Sacha Weatherstone
• Aleksei Sviridkin
• Alexander Soelberg Heidarsson
• Angelos Petheriotis
• Brian Topping
• Christoph Engelbert (noctarius)
• Dennis Docter
• Dima Aratin
• Evan Champion
• GeertJohan
• Ian Atha
• Ivan Demchuk
• Joakim Nohlgård
• Kamil Szczygieł
• Karthik Chowdary
• Kuzia
• Licia Seiker
• Louis Deconinck
• Matt Layher
• MsfPablo
• Noel
• Oguz Kilcan
• Raphaël DUCOM
• Ryuki Maruyama
• Spencer Smith
• Steve Francis
• Steve Wills
• Tom Plant
• Winter
• dadbravo
• leppeK
• neiltalap
• saguila
• usman.malik_ext

Changes

283 commits

• 63b430276 release(v1.15.0-alpha.1): prepare release
• 2682d461e feat: provision blank virtual machine disks in storage pools
• b834e3cb6 fix: remove the NUMANodes flag from cluster create qemu cmd
• 53c484f96 feat: configurable video device for virtual machines
• 340df0456 feat: bump kubernetes to v1.38.0-alpha.2
• 751f65514 feat: show guest VM IPs from qemu-guest-agent
• 3e41f2501 feat: bump deps
• b9e82ebdc fix: vm console queue overflows on read
• 3c0838b39 test: isolate concurrent IPv4 route scope fixtures
• 0e17fa324 test: bound NUMA reconciliation triggers by suite lifetime
• ee6a6bd8a test: synchronize VNC cancellation coverage
• b5f476dda feat: reconcile CPU partition policy
• df0193f5e feat: add authenticated VNC access to virtual machines
• b4178e11a test: distinguish concurrent foreign route fixtures
• 44c569644 chore: add VM serial console release notes
• 4e2e4f308 feat: add host NUMA topology and validate VM placement
• b277651ca feat: attach qemu-guest channel to virtual machines
• 051a4bf6d test: wait for device removal before testing disk recreation
• 04dde9148 test: make DNS bind failure independent of interface addresses
• 4948088b0 feat: add aggregate workload memory limits
• 1227b2b84 feat: provision cloud-init seed assets for virtual machines
• 8fca67333 test: talos container status coverage
• 5ca54ad2e feat: plan safe CPU partition updates
• eb958e61e test: improve hypervisor unit tests stability
• 4194ca142 feat: persist VM serial logs and add explicit log kind selection
• 527a272c5 feat: content lib. locking, vm resource chaining
• cf07b8a7f feat: impl. VirtualMachineConfig - guest
• e18d5ce09 feat: add CPU partition cgroup operations
• 6b1edb94d test: boot stock Alpine ISO over serial console
• 3663614ba feat: rework route configuration
• da3c10225 fix: clean up mountpoints on unmount
• 738f1ab8f fix: roll back stacked try configs to the config before the first try
• e880b96c0 feat: add CPU partition configuration
• bdfe7bd2b test: coverage for explicit vm stop, before delete
• d63f6c38b feat: add CPU partition resource types
• a5aa41488 test(ci): add hypervisor short pipeline
• e7b50c50d feat: vm disk provisioning from iso
• 7396302ba feat: set vm domaincpu to host-model
• 83a80df90 fix: verify the claim for the legacy bundle image verification
• 95c86b810 fix: correct handling of DHCP changing address
• e1386c60d fix: image verification test
• b77b8b8bc feat: add hypervisor VM serial console streaming
• 87e039ea9 fix: make GenerateClientConfiguration API work in K8s-less mode
• bf9d68ed6 feat: update Kubernetes to 1.38.0-alpha.1
• a003bd22b fix: restore source names for pseudo filesystem mounts
• b3736b9a9 fix: network on azure (and might fix some other platforms)
• 41e63cb24 fix: skip impersonation tests without Kubernetes
• ef5bdc8dc fix: gate libvirt dial on virtqemud readiness
• 53fa44cbf fix: add validation for the PTP device name
• b6a32fc16 fix: reject impersonation header without impersonator role
• 76e761d83 fix: validate ExtensionServiceConfig name
• 21b74679f feat: add support for chunked fstrim
• 5b7c96d75 feat: override the kubelet's image GC thresholds
• 7e972eecf feat: impl. hypervisor network tap
• 90e22ed5b feat: update etcd to 3.7.2
• 2363acc1e fix: hv domain status ctrl must use openpersistent
• 6d70efe9f feat: bring in Linux 6.18.54, runc 1.5.2
• 6b333c145 fix: don't overwrite currently booted on upgrade for GRUB
• 1ea1724bb feat: add virtual machine CPU pinning and NUMA placement
• cb9852c4e feat: add VirtualMachineStatus resource
• 13426fd28 test: avoid racing CPU scaling sysfs writes
• cad70acb2 feat: add ignoreCtrlAltDelete to SecurityProfileConfig
• 494abedf6 docs: clarify the KMS endpoint scheme
• fede90e81 feat: talosctl dashboard container support
• 691a26f18 fix: installer-with-extension image tag handling
• 92fdb5b08 test: fix OOM kills in TinkSuite
• bfa1ef264 fix: drop devices from the last observed generation if they are gone
• 8c90991bd feat: add LVFS metadata parsing and PKCS7 verification
• 3f3a1e01a fix: type VM CPU limits for 32-bit talosctl builds
• 6a1ff6688 feat: place virtual machines in a Talos-owned cgroup partition
• 6ced93742 feat: handle the change in kubelet's CPU and memory policies
• 0438aa72d chore: mark generated code and reference docs as generated
• d5393f3ef feat: reconcile virtual machine domains with libvirt
• b230c581a feat: update containerd to 2.3.6
• 0e7245da4 fix: reject extra config merge paths
• f3aa7374c feat: add CPU frequency scaling controller
• cd48649d2 chore: fix build of talosctl on non-Linux
• ab6af70d1 test: fix the md-boot pipeline
• 59ff84267 feat: detect and publish hybrid ISO partitions
• 0e3511020 test: add a test exercising partitions on top of DM devices
• 6304eeb40 fix: relax the validation for block device wipe
• 0553b3e51 feat: support partitions on device mapper devices
• 0962b72d6 fix: disable storagepool controllers in container mode
• 5592dc59a feat: impl. virtualmachineconfig - networking
• 3c9c65f0f chore: validate VM domain XML against libvirt schema
• a61097889 feat: add libvirt storage pool configuration
• 515a590ea fix: pass boot partition UUID on kexec
• b6ec9e7d8 feat: translate virtual machine configuration into domain specs
• a40182833 refactor: hypervisor test pipeline
• fa69d23b5 chore: drop some talosctl gen subcommands
• 6fe8bafa5 fix: perform stricter validation of hostnames/search domains
• ef123b413 feat: update Linux to 6.18.53
• 2976d533f refactor: add enums for vm conf str-fields
• 53ec6047e test: bump Go version for cloud images
• b56f98033 test: fix cilium triggered test
• f11bd1c0a fix: handle correctly routes without outlinkname set
• ab3d78b44 feat: impl. virtualmachineconfig powerstate
• ed7111fbb feat: provide SecureBoot fingerprints used during boot
• 5248bba87 docs: update bug issue template
• ee0a723be fix: do not disclose pre-shared Wireguard key in LinkStatus
• 56f9c6a08 chore: clean up unused settings in LVM reconcile controllers
• a314372a1 feat: impl. virtualmachineconfig - firmware
• 5f0b06335 feat: impl. virtualmachineconfig - console
• 34c306f32 fix: report selected context in talosctl config info
• 36bed8610 fix: retry transient LVM reconciliation failures
• 93c711852 feat: impl. virtualmachineconfig - disks
• f188ff448 feat: content library upload verification
• 4ecd21a54 docs: add a note about the dev command to the qemu command
• df493c685 fix: ignore missing device nodes for inotify
• a4b38516b chore: automatic linting fixes
• dfabc0ed7 chore: update dependencies
• 8cf987052 chore: bump CSI helm charts
• d2de8e21c fix: preserve hostname under Docker (in container mode)
• f04a3438e feat: add macsec module
• 4d024ecf8 feat: add virtualmachineconfig
• 571c4665d refactor: move size types to config/types/meta
• cc815177d fix: apply config patches last in talosctl cluster create
• 9d5901f7d feat: content library api, talosctl support
• 657a95a68 chore: implement controller/resource tracer
• a26d35862 docs: clarify admission control and flannel config docs
• 5d1981eca feat: add contentlibrary resources, ctrl
• b46b3b872 feat: implement boot device wait in volume manager
• 35d67a3a5 test: fix the aws-arm64 test
• 956c739c9 refactor: container dependency status spec
• 05f60de61 feat: report LLDP neighbors on physical links
• 2d2567ba8 fix: use correct conditions on CRI <> sandboxd dependency
• acdcc9cda feat: update Linux to 6.18.52
• 6e59bd86c feat: update SideroLink library to v0.3.18
• 2f5cc2fb0 fix: extend the USB settle code for more code paths
• 0e1fdd26a feat: impl container status controller
• 64c3de56b chore: pass kernel version down to VEX generator
• 8fe31217d chore: update dockerfile syntax
• fe4bd64c9 chore: update integration k8s helm charts
• 0129eac91 chore: update helm, cilium cli
• 817a479c6 chore: update tools and pkgs
• d66c60a98 fix: prevent sandboxd signal dispositions leaking into services
• 64f8f83c1 test: peer passively with the MetalLB speaker
• 75eea7897 test: stop ARP flux breaking the BGP VRF test
• bebcad562 fix: rebuild the BGP server when its VRF is recreated
• 175925220 fix: create GRUB bootloader ISOs only for BIOS
• 78a70ed5e test: check owned mounts in hostns cleanup tests
• ba50b647f test: skip the macvlan DHCP test on full-CLOS clusters
• 7f5327d5b fix: guard against nil config document slices
• 2e23abc13 fix: reconnect the WireGuard over gRPC tunnel after a failure
• a1d2ce2a7 feat: support disk smart config and status
• cc92d40a7 fix: tighten the validation of v1alpha1 configs vs. migration
• 66c7d4505 docs: clarify the kube-apiserver extra args and new config
• 5d2fa54ee test: test Cilium with SELinux enforcing mode
• 8a615bf5a docs: correct the UnattendedInstallConfig name in the schema
• 4327e1083 fix: make --insecure reachable for talosctl meta subcommands
• f715d06a4 fix: ignore apply config dry-run for try mode
• 850a4384b test: add a way to provision extra DHCP entries in the test
• 8537cf06b fix: drop logical links if they no longer declare as logical
• b8aa858d9 fix: resolve volume devices in shared selector helper
• 64355d0e3 fix: create LVM physical volumes on the decrypted device
• 189086bd6 fix: bump history max cap to 1536
• ee71f190e feat: upate Linux to 6.18.50
• b735fd683 feat: add NixOS OVMF search path
• f593732fa fix: support ARMv7 talosctl builds
• 682a0c96d fix: gate NFS server behind linux build tag
• 5c5fd29e9 fix: restrict generated configuration file permissions
• 85aa3ea93 feat: discover bmc over local ipmi interface
• 7ee755a87 feat: add NFS external volume support
• 12dfb8e1a release(v1.15.0-alpha.0): prepare release
• f3017d31e fix: add missing extension test patches for nfs
• 67ae852a9 fix: wait for USB settle explicitly
• 274dc8581 fix(security): define the permissions the 6.18 kernel expects in the classes
• 28841f4c4 fix: empty searchdomains dropped on merge
• 5a67d1e8e chore: support correctly various disk types for the system disk
• 834ba888a fix: improve resilience of the action tracker against dropped conns
• a2d35a90c fix: notify about link alias changes
• 9de219cfb test: nvidia - switch to nri
• 24ef6f436 fix: use the final config version in upgrade-k8s
• a1ec9d567 docs: update CODE_OF_CONDUCT.md
• 6a8b836f2 fix: set TCP keealive and user timeout on apid proxied connections
• 607ee15c9 chore: use the host page cache for the QEMU cluster disks
• a6bde65fd feat: allow generating an ECDSA service account key in secrets bundles
• ecb012883 feat: update containerd to 2.3.5
• 54204560c feat: bump to containerd config version 4
• a42ea1d4a feat: add KubeSpan peer endpoint filters
• 0bd0cc8fc fix: ensure lockdown integrity in SecureBoot mode
• 7eb4e75c1 feat: add KmsgLogConfig extraTags support
• 01ebf95a0 feat: add VXLAN interface configuration support
• 019b5f432 feat: add macvlan interface configuration support
• f5dc088fd fix: correct the bug with overlay assets in ESP being dropped
• 465a691f7 feat: update Linux to 6.18.49
• 0666eed65 fix: harden the code around kubelet's client certificate handling
• 5a2dfd460 test: revert disabling PS/2 in QEMU
• 6b16225b6 fix: correct typos in talosctl output, comments and config example
• 5da7387c9 docs: fix containerconfig.dependson examples
• 9f2eb6fb4 test: relax OOM test conditions
• 9361ad0c1 fix: normalize image reference when passing to image verification flow
• 7fd43a419 fix: name diskSelector in UnattendedInstallConfig validation errors
• 7aeb7d4a8 test: isolate base OCI spec test in BGP CLOS runs
• 27ea73811 feat: add USB LAN78XX drivers to the rootfs
• d7d41b53d fix: filter out passed metadata in API proxying
• ba625bc5e fix: allow CSI volumes to be mounted with an SELinux context
• fc0a1f020 test: libvirtd extensions
• 6e1c0cd42 fix: filter the output in talosctl
• b1b173f59 fix: treat desired roles empty as error in Talos API access
• ed3a1e091 fix: handle Akamai/Linode metadata without IPv6
• 9c058f898 feat: talos containers run with imagegccontroller
• 9cba2783f fix: container mount rshared propagation
• 241d55f37 refactor: don't skip container tests in short mode
• 10e8fb449 fix: ctr machinedaccss allowed roles
• 86628c57e fix: validate received kubeconfig
• 083e7f923 fix: drop dead legacy registries init from worker generation
• a8c09fb73 fix: exclude scheduler config from apiserver config version
• b46c53e8f fix: keep the time sync boot timeout across a syncer restart
• a4707d403 test: skip filemap heap test under race detector
• 86bfa8c21 feat: bump kernel to 6.18.48
• 6ee461278 fix: escape output in the talosctl dashboard
• 1ee84b268 fix: use os.Root in the talosctl extract path
• d970ebca4 chore: speed up unit-tests
• d5f53edee fix: add checks for meta key in the API path
• 6b1d1845c feat: update COSI to 1.16.3
• bfb8dfcc4 feat: add host extension pre-shutdown hooks
• e434671d7 fix: preserve shared libs symlinks
• fd0eee43f fix: drop libssl from the rootfs
• f7065d3c2 fix: route creation churning every 100ms
• 6f7b08ab4 chore: reduce verbosity of the grype scan
• 4f7f5c2fa fix: drop gRPC client keepalive aggressive settings in the tracker
• 1b1905a07 chore: bump sigstore/rekor to v1.5.4
• ea5484ba2 chore: add SPD5118 driver to squashfs
• 770e5cdd6 fix: preserve special modes when extracting files
• 613463d64 feat: containers can connect to machined
• abff95d73 feat: bump kubernetes to 1.37.0
• ba2d9a773 refactor: log filter stays enabled on enter press
• 0179b80f5 fix: hostns etc mount
• 6dcde1d9e feat: impl. container mount controller
• 48fe469a8 fix: write the uploaded etcd snapshot atomically
• f25b4a3cc chore: update multipath notes
• 86d76b0df feat: support host extension services
• d70eb0078 feat: talos containers support for talosctl
• 4f56e5f44 fix: cache filemap layers on disk
• 1bb6e1f10 fix: skip selinux label for read-only/detached/external mounts
• 7ca297a11 feat: add xfrm interface module
• e489f9538 fix: capture packets correctly on VLANs
• e12769b1f test: update Image Factory Talos versions
• 17b631eb0 feat: update Linux to 6.18.46
• 00ec33789 fix: enable additional SELinux permissions for Cilium
• 9c747cb2e fix: use os.Root in the untar path
• f48e688bf docs: update CRI customization example
• 15c3d1a4b test: apid tls provider
• 8979ecefe feat: impl. container runtime controller
• 0ae93592b refactor: make runner.runner context-native
• 48e604d52 fix(talosctl): preserve uncompressed cached image layers
• 1205defbb fix: use default terminal theme colors in talosctl dashboard
• e8872ff71 fix: don't create new client in dry-run mode
• f61de6f44 fix: preserve selected sd-boot entry on upgrade
• ad8823176 feat: add a talosctl df command
• 78e378a48 fix: use the UKI command line when the config has no install section
• a469e965a fix: persist in-memory meta on fresh install
• a72281e5b fix: drop lockdown=confidentiality default for 1.14+
• f80fd0985 fix: reduce stalls in the etcd member promotion cycle
• 3b3e0e955 feat: update Go to 1.26.7
• 41c0c0a02 feat: update CoreDNS to 1.14.7
• 481f98d8c feat: update Kubernetes to 1.37.0-rc.1
• dcfb17c96 feat: implement support for primary setting for the BondConfig
• 63bd62c9c fix: watch IPv6 route changes in RouteSpecController
• b2693f08e feat: update Linux to 6.18.45
• 398d2be8d fix: enable SELinux to work with overlays
• df72d021f fix: move the spike information field of the time.Status resource
• 8b5f1097b chore: ensure nightlies only run in one region
• f7305d6f5 feat: impl ContainerInstanceController
• fdf0efa8b feat: log peer address in gRPC request log
• 013b9489e feat: talosctl dashboard log filtering
• 5fcf360fe fix: truncate files replaced by system extensions
• 4c575c207 fix: skip target settings for external volume mounts
• c685f2712 chore: update disvulncheck dates
• aaf35fbde fix: use v1.13 config to test downgrade failure
• 2b0316913 test: use tiny hostns debug image
• 42d72ed56 feat: move IPVS support into modules
• be6b96386 fix: support try mode apply without prior config
• 68876cc1e fix: adjust cluster size for VFAT on ISO
• 9cb5dc9b9 feat: update containerd to 2.3.4
• 32f7fc0df feat: impl ContainerImageController
• 5675ada21 test: add cachefilesd to the test matrix
• a1183478a fix: apply directory user volume mount security
• 55e0f6350 fix: install conntrack handler in accept ingress firewall mode
• 1c50b73fb fix: share IPC namespace with the host for extension services
• 6cda3e2e2 chore: prepare for Talos 1.15
• 8514d9963 fix: provide read-only random seed in the ISO

Changes since v1.15.0-alpha.0

163 commits

• 63b430276 release(v1.15.0-alpha.1): prepare release
• 2682d461e feat: provision blank virtual machine disks in storage pools
• b834e3cb6 fix: remove the NUMANodes flag from cluster create qemu cmd
• 53c484f96 feat: configurable video device for virtual machines
• 340df0456 feat: bump kubernetes to v1.38.0-alpha.2
• 751f65514 feat: show guest VM IPs from qemu-guest-agent
• 3e41f2501 feat: bump deps
• b9e82ebdc fix: vm console queue overflows on read
• 3c0838b39 test: isolate concurrent IPv4 route scope fixtures
• 0e17fa324 test: bound NUMA reconciliation triggers by suite lifetime
• ee6a6bd8a test: synchronize VNC cancellation coverage
• b5f476dda feat: reconcile CPU partition policy
• df0193f5e feat: add authenticated VNC access to virtual machines
• b4178e11a test: distinguish concurrent foreign route fixtures
• 44c569644 chore: add VM serial console release notes
• 4e2e4f308 feat: add host NUMA topology and validate VM placement
• b277651ca feat: attach qemu-guest channel to virtual machines
• 051a4bf6d test: wait for device removal before testing disk recreation
• 04dde9148 test: make DNS bind failure independent of interface addresses
• 4948088b0 feat: add aggregate workload memory limits
• 1227b2b84 feat: provision cloud-init seed assets for virtual machines
• 8fca67333 test: talos container status coverage
• 5ca54ad2e feat: plan safe CPU partition updates
• eb958e61e test: improve hypervisor unit tests stability
• 4194ca142 feat: persist VM serial logs and add explicit log kind selection
• 527a272c5 feat: content lib. locking, vm resource chaining
• cf07b8a7f feat: impl. VirtualMachineConfig - guest
• e18d5ce09 feat: add CPU partition cgroup operations
• 6b1edb94d test: boot stock Alpine ISO over serial console
• 3663614ba feat: rework route configuration
• da3c10225 fix: clean up mountpoints on unmount
• 738f1ab8f fix: roll back stacked try configs to the config before the first try
• e880b96c0 feat: add CPU partition configuration
• bdfe7bd2b test: coverage for explicit vm stop, before delete
• d63f6c38b feat: add CPU partition resource types
• a5aa41488 test(ci): add hypervisor short pipeline
• e7b50c50d feat: vm disk provisioning from iso
• 7396302ba feat: set vm domaincpu to host-model
• 83a80df90 fix: verify the claim for the legacy bundle image verification
• 95c86b810 fix: correct handling of DHCP changing address
• e1386c60d fix: image verification test
• b77b8b8bc feat: add hypervisor VM serial console streaming
• 87e039ea9 fix: make GenerateClientConfiguration API work in K8s-less mode
• bf9d68ed6 feat: update Kubernetes to 1.38.0-alpha.1
• a003bd22b fix: restore source names for pseudo filesystem mounts
• b3736b9a9 fix: network on azure (and might fix some other platforms)
• 41e63cb24 fix: skip impersonation tests without Kubernetes
• ef5bdc8dc fix: gate libvirt dial on virtqemud readiness
• 53fa44cbf fix: add validation for the PTP device name
• b6a32fc16 fix: reject impersonation header without impersonator role
• 76e761d83 fix: validate ExtensionServiceConfig name
• 21b74679f feat: add support for chunked fstrim
• 5b7c96d75 feat: override the kubelet's image GC thresholds
• 7e972eecf feat: impl. hypervisor network tap
• 90e22ed5b feat: update etcd to 3.7.2
• 2363acc1e fix: hv domain status ctrl must use openpersistent
• 6d70efe9f feat: bring in Linux 6.18.54, runc 1.5.2
• 6b333c145 fix: don't overwrite currently booted on upgrade for GRUB
• 1ea1724bb feat: add virtual machine CPU pinning and NUMA placement
• cb9852c4e feat: add VirtualMachineStatus resource
• 13426fd28 test: avoid racing CPU scaling sysfs writes
• cad70acb2 feat: add ignoreCtrlAltDelete to SecurityProfileConfig
• 494abedf6 docs: clarify the KMS endpoint scheme
• fede90e81 feat: talosctl dashboard container support
• 691a26f18 fix: installer-with-extension image tag handling
• 92fdb5b08 test: fix OOM kills in TinkSuite
• bfa1ef264 fix: drop devices from the last observed generation if they are gone
• 8c90991bd feat: add LVFS metadata parsing and PKCS7 verification
• 3f3a1e01a fix: type VM CPU limits for 32-bit talosctl builds
• 6a1ff6688 feat: place virtual machines in a Talos-owned cgroup partition
• 6ced93742 feat: handle the change in kubelet's CPU and memory policies
• 0438aa72d chore: mark generated code and reference docs as generated
• d5393f3ef feat: reconcile virtual machine domains with libvirt
• b230c581a feat: update containerd to 2.3.6
• 0e7245da4 fix: reject extra config merge paths
• f3aa7374c feat: add CPU frequency scaling controller
• cd48649d2 chore: fix build of talosctl on non-Linux
• ab6af70d1 test: fix the md-boot pipeline
• 59ff84267 feat: detect and publish hybrid ISO partitions
• 0e3511020 test: add a test exercising partitions on top of DM devices
• 6304eeb40 fix: relax the validation for block device wipe
• 0553b3e51 feat: support partitions on device mapper devices
• 0962b72d6 fix: disable storagepool controllers in container mode
• 5592dc59a feat: impl. virtualmachineconfig - networking
• 3c9c65f0f chore: validate VM domain XML against libvirt schema
• a61097889 feat: add libvirt storage pool configuration
• 515a590ea fix: pass boot partition UUID on kexec
• b6ec9e7d8 feat: translate virtual machine configuration into domain specs
• a40182833 refactor: hypervisor test pipeline
• fa69d23b5 chore: drop some talosctl gen subcommands
• 6fe8bafa5 fix: perform stricter validation of hostnames/search domains
• ef123b413 feat: update Linux to 6.18.53
• 2976d533f refactor: add enums for vm conf str-fields
• 53ec6047e test: bump Go version for cloud images
• b56f98033 test: fix cilium triggered test
• f11bd1c0a fix: handle correctly routes without outlinkname set
• ab3d78b44 feat: impl. virtualmachineconfig powerstate
• ed7111fbb feat: provide SecureBoot fingerprints used during boot
• 5248bba87 docs: update bug issue template
• ee0a723be fix: do not disclose pre-shared Wireguard key in LinkStatus
• 56f9c6a08 chore: clean up unused settings in LVM reconcile controllers
• a314372a1 feat: impl. virtualmachineconfig - firmware
• 5f0b06335 feat: impl. virtualmachineconfig - console
• 34c306f32 fix: report selected context in talosctl config info
• 36bed8610 fix: retry transient LVM reconciliation failures
• 93c711852 feat: impl. virtualmachineconfig - disks
• f188ff448 feat: content library upload verification
• 4ecd21a54 docs: add a note about the dev command to the qemu command
• df493c685 fix: ignore missing device nodes for inotify
• a4b38516b chore: automatic linting fixes
• dfabc0ed7 chore: update dependencies
• 8cf987052 chore: bump CSI helm charts
• d2de8e21c fix: preserve hostname under Docker (in container mode)
• f04a3438e feat: add macsec module
• 4d024ecf8 feat: add virtualmachineconfig
• 571c4665d refactor: move size types to config/types/meta
• cc815177d fix: apply config patches last in talosctl cluster create
• 9d5901f7d feat: content library api, talosctl support
• 657a95a68 chore: implement controller/resource tracer
• a26d35862 docs: clarify admission control and flannel config docs
• 5d1981eca feat: add contentlibrary resources, ctrl
• b46b3b872 feat: implement boot device wait in volume manager
• 35d67a3a5 test: fix the aws-arm64 test
• 956c739c9 refactor: container dependency status spec
• 05f60de61 feat: report LLDP neighbors on physical links
• 2d2567ba8 fix: use correct conditions on CRI <> sandboxd dependency
• acdcc9cda feat: update Linux to 6.18.52
• 6e59bd86c feat: update SideroLink library to v0.3.18
• 2f5cc2fb0 fix: extend the USB settle code for more code paths
• 0e1fdd26a feat: impl container status controller
• 64c3de56b chore: pass kernel version down to VEX generator
• 8fe31217d chore: update dockerfile syntax
• fe4bd64c9 chore: update integration k8s helm charts
• 0129eac91 chore: update helm, cilium cli
• 817a479c6 chore: update tools and pkgs
• d66c60a98 fix: prevent sandboxd signal dispositions leaking into services
• 64f8f83c1 test: peer passively with the MetalLB speaker
• 75eea7897 test: stop ARP flux breaking the BGP VRF test
• bebcad562 fix: rebuild the BGP server when its VRF is recreated
• 175925220 fix: create GRUB bootloader ISOs only for BIOS
• 78a70ed5e test: check owned mounts in hostns cleanup tests
• ba50b647f test: skip the macvlan DHCP test on full-CLOS clusters
• 7f5327d5b fix: guard against nil config document slices
• 2e23abc13 fix: reconnect the WireGuard over gRPC tunnel after a failure
• a1d2ce2a7 feat: support disk smart config and status
• cc92d40a7 fix: tighten the validation of v1alpha1 configs vs. migration
• 66c7d4505 docs: clarify the kube-apiserver extra args and new config
• 5d2fa54ee test: test Cilium with SELinux enforcing mode
• 8a615bf5a docs: correct the UnattendedInstallConfig name in the schema
• 4327e1083 fix: make --insecure reachable for talosctl meta subcommands
• f715d06a4 fix: ignore apply config dry-run for try mode
• 850a4384b test: add a way to provision extra DHCP entries in the test
• 8537cf06b fix: drop logical links if they no longer declare as logical
• b8aa858d9 fix: resolve volume devices in shared selector helper
• 64355d0e3 fix: create LVM physical volumes on the decrypted device
• 189086bd6 fix: bump history max cap to 1536
• ee71f190e feat: upate Linux to 6.18.50
• b735fd683 feat: add NixOS OVMF search path
• f593732fa fix: support ARMv7 talosctl builds
• 682a0c96d fix: gate NFS server behind linux build tag
• 5c5fd29e9 fix: restrict generated configuration file permissions
• 85aa3ea93 feat: discover bmc over local ipmi interface
• 7ee755a87 feat: add NFS external volume support

Changes from siderolabs/gen

2 commits

• siderolabs/gen@cbd9518 chore: rekres and update deps
• siderolabs/gen@26ccee1 feat: provide new YAMl unmarshal validator for null values

Changes from siderolabs/go-debug

1 commit

• siderolabs/go-debug@44d6398 feat: support Go 1.27

Changes from siderolabs/go-kubernetes

2 commits

• siderolabs/go-kubernetes@1a7f4fb fix: set a logger on the ssa controller-runtime client
• siderolabs/go-kubernetes@f752bb3 feat: add Kubernetes 1.38 compatibility

Changes from siderolabs/go-lldp

4 commits

• siderolabs/go-lldp@09c4339 feat: add a Linux LLDP receiver
• siderolabs/go-lldp@76e7def fix: stop LLDP decoding at the end marker
• siderolabs/go-lldp@a5ba2a7 chore: kresify and lint fixes
• siderolabs/go-lldp@afd9f83 lldp: initial commit

Changes from siderolabs/go-pcidb

1 commit

• siderolabs/go-pcidb@78c9051 feat: update PCI IDs to the latest available

Changes from siderolabs/pkgs

53 commits

• siderolabs/pkgs@305b1b6 feat: bump deps
• siderolabs/pkgs@2a7769e feat: enable bhyve guest support on amd64
• siderolabs/pkgs@ce4bafb feat: enable CONFIG_DRM_ACCEL_AMDXDNA on amd64
• siderolabs/pkgs@8f7ce6c feat: enable CONFIG_MOTORCOMM_PHY on arm64
• siderolabs/pkgs@fa71c34 feat: enable pNFS block and SCSI layouts in nfsd
• siderolabs/pkgs@f6b8411 feat: add hailort v5 package
• siderolabs/pkgs@64af669 feat: enable Qualcomm Cloud AI 100 (QAIC) driver
• siderolabs/pkgs@518972a fix: add a patch to fix booting on Apple hardware
• siderolabs/pkgs@2b782b6 feat: update Linux to 6.18.54, runc to 1.5.2
• siderolabs/pkgs@4871c10 feat: enable CONFIG_CRYPTO_ECC, CONFIG_CRYPTO_ECDH on arm64 to match amd64
• siderolabs/pkgs@b4cb94c feat: enable CONFIG_BLK_WBT
• siderolabs/pkgs@6868054 feat: update containerd to 2.3.6
• siderolabs/pkgs@55806c6 feat: update systemd to v262
• siderolabs/pkgs@a2b57ee fix: add missing sboms for swtpm
• siderolabs/pkgs@12b29b3 feat: update Linux to 6.18.53
• siderolabs/pkgs@6868000 feat: bump dependencies
• siderolabs/pkgs@bed8e18 feat: add swtpm
• siderolabs/pkgs@777c95f feat: enable CONFIG_MACSEC in the kernel
• siderolabs/pkgs@99ec357 feat: update DRBD & Linux firmware
• siderolabs/pkgs@a51429b feat(kernel): enable CONFIG_NO_HZ_FULL
• siderolabs/pkgs@b39d2c3 feat: update Linux to 6.18.52
• siderolabs/pkgs@69ed550 feat: update Linux to 6.18.51
• siderolabs/pkgs@f380535 chore: rekres
• siderolabs/pkgs@05913b5 chore: updates 2026-09-10
• siderolabs/pkgs@1a28bfb chore: update tools, toolchain, rustc
• siderolabs/pkgs@e7b09e2 feat: enable earth-pt3 dvb driver
• siderolabs/pkgs@5096469 feat: update libpathrs to 0.2.6
• siderolabs/pkgs@43e533c feat: update Linux to 6.18.50
• siderolabs/pkgs@977b61f feat: update containerd to 2.3.5
• siderolabs/pkgs@43e6298 fix: add a kernel patch for EFI SecureBoot integrity lockdown
• siderolabs/pkgs@a8b682b feat: add kernel modules to enable Intel HD audio
• siderolabs/pkgs@ff111ff feat: enable Apple Silicon platform drivers
• siderolabs/pkgs@e68eeb5 feat: enable VIRTIO_INPUT as built-in for amd64/arm64
• siderolabs/pkgs@381fc2d feat: bump kernel to 6.18.49
• siderolabs/pkgs@5394321 feat: enable CONFIG_USB_LAN78XX and CONFIG_MICROCHIP_PHY on amd64
• siderolabs/pkgs@4b9bf36 fix: preserve symlinks for libudev
• siderolabs/pkgs@50bf09f fix: update OpenSSL to 3.6.4
• siderolabs/pkgs@f2b7acf feat: update kernel to 6.18.48
• siderolabs/pkgs@73327ff feat: bump kernel to 6.18.47
• siderolabs/pkgs@b6b2843 feat: enable CONFIG_XFRM_INTERFACE in the kernel
• siderolabs/pkgs@696fa3c feat: expose more software as pkgs
• siderolabs/pkgs@aa069d3 chore: update OpenZFS to 2.4.4
• siderolabs/pkgs@c1837b6 feat: bump kernel to 6.18.46
• siderolabs/pkgs@28f5f23 feat: enable SPD5118 sensor driver
• siderolabs/pkgs@bc45b69 feat: backport aes256k support (Ceph)
• siderolabs/pkgs@b914c26 feat: update Go to 1.26.7
• siderolabs/pkgs@caac515 feat: update Linux to 6.18.45
• siderolabs/pkgs@ada230a feat: enable IPSec offload and dma-buf heaps
• siderolabs/pkgs@33d14e0 feat(kernel): enable CONFIG_MLX5_VFIO_PCI
• siderolabs/pkgs@107b628 feat: kernel: enable MPTCP, sched_ext
• siderolabs/pkgs@c9173bb feat: move IPVS into modules
• siderolabs/pkgs@d418aa7 feat: update containerd to 2.3.4
• siderolabs/pkgs@c4a6a61 feat: update Go to 1.26.6

Changes from siderolabs/siderolink

6 commits

• siderolabs/siderolink@755a982 chore: update dependencies and rekres
• siderolabs/siderolink@5d6e09f fix: rework keying of the streams to the peers
• siderolabs/siderolink@ad296ab chore: rekres, bump deps
• siderolabs/siderolink@23030b0 fix: keep a replacement gRPC stream's send queue after cleanup
• siderolabs/siderolink@4b69f46 fix: correct the wireguard device error handling
• siderolabs/siderolink@5157d0c fix: accept valid short IPv6 packets on filtered devices

Changes from siderolabs/tools

13 commits

• siderolabs/tools@32e115c fix: restore llvm 22 for rust compatibility
• siderolabs/tools@47166ad feat: bump deps
• siderolabs/tools@d40b203 feat: update tools components
• siderolabs/tools@19bb4b7 chore: downgrade llvm to major 22
• siderolabs/tools@b28aa66 chore: bump util-linux 2.42.3
• siderolabs/tools@1023701 chore: update dependencies 2026-09-08
• siderolabs/tools@c3165c7 chore: update toolchain image
• siderolabs/tools@09ccc74 feat: bump go to 1.26.8
• siderolabs/tools@35fab51 fix: update OpenSSL to 3.6.4
• siderolabs/tools@e033f2a feat: move more packages into separate images
• siderolabs/tools@d102f15 feat: update Go to 1.26.7
• siderolabs/tools@fd531a3 feat: update Go to 1.26.6
• siderolabs/tools@5eabe31 chore: rekres 2026-08-12

Dependency Changes

• cel.dev/cel-go v0.32.0 new
• cloud.google.com/go/compute/metadata v0.9.0 -> v0.9.1
• codeberg.org/miekg/dns v0.6.90 -> v0.6.114
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 -> v1.23.1
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 -> v1.14.1
• github.com/anatol/smart.go 486c28b93357 new
• github.com/aws/aws-sdk-go-v2 v1.43.4 -> v1.47.0
• github.com/aws/aws-sdk-go-v2/config v1.32.35 -> v1.33.5
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 -> v1.20.0
• github.com/aws/aws-sdk-go-v2/service/acm v1.43.4 -> v1.50.0
• github.com/aws/aws-sdk-go-v2/service/kms v1.55.4 -> v1.61.0
• github.com/aws/smithy-go v1.27.7 -> v1.28.2
• github.com/beevik/nts v0.3.1 -> v0.3.2
• github.com/bougou/go-ipmi v0.9.1 new
• github.com/containerd/containerd/v2 v2.3.4 -> v2.3.6
• github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5
• github.com/containernetworking/cni v1.3.0 -> v1.3.1
• github.com/digitalocean/go-libvirt 1a83157e1858 new
• github.com/digitorus/pkcs7 ffadbf3f398c new
• github.com/diskfs/go-diskfs v1.9.4 new
• github.com/docker/cli v29.7.2 -> v29.8.1
• github.com/dustin/go-humanize v1.0.1 -> v1.1.0
• github.com/google/cadvisor/lib v0.60.5 -> v0.60.6
• github.com/google/go-containerregistry v0.21.9 -> v0.22.1
• github.com/google/go-eventlog v0.0.2 new
• github.com/gopacket/gopacket v1.7.1 -> v1.7.2
• github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 -> v2.3.4
• github.com/hashicorp/go-getter/v2 v2.2.3 -> v2.2.4
• github.com/hetznercloud/hcloud-go/v2 v2.47.0 -> v2.48.0
• github.com/insomniacslk/dhcp c308df0fdcef -> 234b97448fae
• github.com/klauspost/compress v1.19.2 -> v1.20.0
• github.com/lestrrat-go/helium v0.8.0 new
• github.com/linode/go-metadata v0.3.0 -> v0.3.1
• github.com/marmos91/dittofs v0.32.0 new
• github.com/mdlayher/ethernet 529eae5b6118 new
• github.com/miekg/dns v1.1.72 -> v1.1.73
• github.com/moby/moby/api v1.55.0 -> v1.56.0
• github.com/moby/moby/client v0.5.1 -> v0.6.0
• github.com/osrg/gobgp/v4 v4.8.0 -> v4.9.0
• github.com/prometheus/procfs v0.21.1 -> v0.22.0
• github.com/siderolabs/gen v0.8.7 -> v0.8.8
• github.com/siderolabs/go-blockdevice/v2 v2.0.32 -> v2.0.36
• github.com/siderolabs/go-debug v0.6.2 -> v0.6.3
• github.com/siderolabs/go-kubernetes v0.2.41 -> v0.2.43
• github.com/siderolabs/go-lldp v0.1.0 new
• github.com/siderolabs/go-pcidb v0.3.3 -> v0.3.4
• github.com/siderolabs/pkgs v1.14.0-15-g2f03590 -> v1.15.0-alpha.0-52-g305b1b6
• github.com/siderolabs/siderolink v0.3.16 -> v0.3.18
• github.com/siderolabs/talos/pkg/machinery v1.14.0 -> v1.15.0-alpha.1
• github.com/siderolabs/tools v1.14.0-5-g87316ca -> v1.15.0-alpha.0-12-g32e115c
• github.com/sigstore/sigstore v1.10.9 -> v1.10.10
• github.com/sirupsen/logrus v1.9.4 -> v1.10.2
• github.com/ulikunitz/xz v0.5.16 -> v0.5.17
• go.etcd.io/etcd/api/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/client/pkg/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/client/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/etcdutl/v3 v3.7.1 -> v3.7.2
• go4.org/netipx fdeea329fbba -> 3075585bcbeb
• golang.org/x/oauth2 v0.36.0 -> v0.37.0
• golang.org/x/sync v0.22.0 -> v0.24.0
• golang.org/x/term v0.45.0 -> v0.47.0
• golang.org/x/time v0.15.0 -> v0.16.0
• google.golang.org/grpc v1.83.2 -> v1.84.0
• k8s.io/api v0.37.0 -> v0.38.0-alpha.2
• k8s.io/apiextensions-apiserver v0.37.0 -> v0.38.0-alpha.2
• k8s.io/apimachinery v0.37.0 -> v0.38.0-alpha.2
• k8s.io/apiserver v0.37.0 -> v0.38.0-alpha.2
• k8s.io/client-go v0.37.0 -> v0.38.0-alpha.2
• k8s.io/component-base v0.37.0 -> v0.38.0-alpha.2
• k8s.io/cri-api v0.37.0 -> v0.38.0-alpha.2
• k8s.io/kube-proxy v0.37.0 -> v0.38.0-alpha.2
• k8s.io/kube-scheduler v0.37.0 -> v0.38.0-alpha.2
• k8s.io/kubectl v0.37.0 -> v0.38.0-alpha.2
• k8s.io/kubelet v0.37.0 -> v0.38.0-alpha.2
• k8s.io/pod-security-admission v0.37.0 -> v0.38.0-alpha.2
• k8s.io/utils cf1189d6abe3 new
• libvirt.org/go/libvirtxml v1.12007.0 new
• sigs.k8s.io/hydrophone v0.7.0 -> v0.8.0

Previous release can be found at v1.14.0

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.7.2
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.38.0-alpha.2
registry.k8s.io/kube-controller-manager:v1.38.0-alpha.2
registry.k8s.io/kube-scheduler:v1.38.0-alpha.2
registry.k8s.io/kube-proxy:v1.38.0-alpha.2
ghcr.io/siderolabs/kubelet:v1.38.0-alpha.2
registry.k8s.io/networking/kube-network-policies:v1.1.2
ghcr.io/siderolabs/installer-base:v1.15.0-alpha.1
ghcr.io/siderolabs/imager:v1.15.0-alpha.1
ghcr.io/siderolabs/talos:v1.15.0-alpha.1
ghcr.io/siderolabs/talosctl-all:v1.15.0-alpha.1
ghcr.io/siderolabs/overlays:v1.15.0-alpha.1
ghcr.io/siderolabs/extensions:v1.15.0-alpha.1

---

This discussion was created from the release v1.15.0-alpha.1.