Releases · siderolabs/talos

Repository navigation

Release list

v1.15.0-alpha.1 Pre-release

Pre-release

github-actions released this 13 Oct 08:39

Immutable

v1.15.0-alpha.1

63b4302

Talos 1.15.0-alpha.1 (2026-10-13)

Welcome to the v1.15.0-alpha.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Boot Partition Wait

Talos now waits for the partition it was booted from to be discovered before declaring the system volumes (META, STATE) missing
and entering maintenance mode, so that disks enumerated late (SD cards, USB, some RAID controllers) are not mistaken for a fresh machine.

On UEFI systems booted via systemd-boot the boot partition comes from the LoaderDevicePartUUID EFI variable, while the GRUB configuration
now passes the talos.boot.partuuid=<UUID> kernel argument (probed by GRUB at boot). The detected boot partition is published as the bootpartition resource.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

containerd only migrates configuration from older versions, so any custom CRI configuration provided via
CRICustomizationConfig documents (or shipped by system extensions) is now interpreted as version 4, and settings
which moved in version 4 are silently ignored (only a Ignoring unknown key in TOML warning is logged by containerd).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

version 3	version 4
`[metrics]` `address`	`[plugins."io.containerd.server.v1.metrics"]` `address`
`[metrics]` `grpc_histogram`	`[plugins."io.containerd.metrics.v1.grpc-prometheus"]` `grpc_histogram`
`[grpc]` `address`, `uid`, `gid`, `max_recv_message_size`, `max_send_message_size`	`[plugins."io.containerd.server.v1.grpc"]` (same keys)
`[grpc]` `tcp_address`, `tcp_tls_ca`, `tcp_tls_cert`, `tcp_tls_key`, `tcp_tls_common_name`	`[plugins."io.containerd.server.v1.grpc-tcp"]` `address`, `tls_ca`, `tls_cert`, `tls_key`, `tls_common_name`
`[ttrpc]` `address`, `uid`, `gid`	`[plugins."io.containerd.server.v1.ttrpc"]` (same keys)
`[debug]` `address`, `uid`, `gid`	`[plugins."io.containerd.server.v1.debug"]` (same keys)

For example, the containerd metrics customization documented for previous versions of Talos:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [metrics]
    address = "0.0.0.0:11234"

should now be written as:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [plugins."io.containerd.server.v1.metrics"]
    address = "0.0.0.0:11234"

Note that [debug] level, format and log_trace_id stay at the top level, and that the ttrpc address is no longer
derived from the grpc address: if the grpc address is customized, the ttrpc plugin address has to be set explicitly.

Unified --namespace Flag

talosctl containers, logs, stats and restart now select the containerd namespace through the same --namespace flag and vocabulary already used by talosctl image and talosctl debug: system (the default), cri for Kubernetes workloads, and taloscontainers for containers declared via a ContainerConfig document.

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

talosctl image list also supports --namespace taloscontainers, to inspect images pulled for ContainerConfig containers. talosctl debug does not support the taloscontainers namespace.

CPU Scaling Configuration

CPU frequency scaling can now be configured declaratively with the CPUScalingConfig document, instead of through kernel arguments
or raw SysfsConfig keys:

apiVersion: v1alpha1
kind: CPUScalingConfig
name: all-cores
selector:
  match: true
governor: performance

Settings apply to the cpufreq policies matched by the selector, which targets cores by property rather than by index, so a machine
whose cores are not uniform can be configured without hardcoding how many it has:

apiVersion: v1alpha1
kind: CPUScalingConfig
name: performance-cores
selector:
  match: cpu.core_type == "performance"
governor: performance
---
apiVersion: v1alpha1
kind: CPUScalingConfig
name: efficiency-cores
selector:
  match: cpu.core_type == "efficiency"
governor: powersave

The selector matches against the fields of the CPUScalingStatus resource, and may also set energyPerformancePreference,
minFrequencyKhz and maxFrequencyKhz. Where several documents match the same policy, the one whose name sorts first wins, and the
document which claimed a policy is reported on the resulting CPUScalingSpec resource. Removing the configuration restores the
values the machine booted with.

Setting a cpufreq attribute through both CPUScalingConfig and SysfsConfig is rejected, as the two would otherwise overwrite each
other continuously.

Disk SMART Status

Talos can now collect SMART (Self-Monitoring, Analysis and Reporting Technology) health information from disks,
exposed via the new SMARTStatus resource (one per disk, keyed by the disk device name).

Collection is controlled by the presence of the new DiskSMARTConfig document: while the document is part of
the machine configuration SMART status is collected, and removing the document disables collection (any
SMARTStatus resources already produced are removed as well). There is no enabled field.

apiVersion: v1alpha1
kind: DiskSMARTConfig
interval: 30m0s

talosctl gen config and talosctl cluster create emit this document by default, so SMART status collection
is enabled by default for machine configurations generated by Talos 1.15. Clusters upgraded from an earlier
version keep their existing machine configuration, which carries no DiskSMARTConfig document, so SMART
status collection stays off there until the document is added.

Rotational disks are never spun up just to be probed: a disk in standby is detected via ATA
CHECK POWER MODE and its SMART data is left untouched until it is active again.

To retrieve SMART statuses:

talosctl get smart

The resource reports an overall health verdict, temperature, power-on hours and power cycles, NVMe wear
indicators (percent used, available spare, critical warning, media errors) and, for ATA/SATA disks, the raw
SMART attribute table with per-attribute thresholds.

Disk Free

A new talosctl diskfree command (aliased to df) reports storage and inode usage for mounted volumes.

Extension Service Configuration

ExtensionServiceConfig is supported only for extension services whose service manifest explicitly declares a configuration dependency:

depends:
  - configuration: true

Using ExtensionServiceConfig with a service that does not declare this dependency is unsupported and has undefined startup behavior.
The service might start before its configuration is rendered, leaving config files or environment variables unavailable until a later service restart.
Extension authors must declare the dependency before documenting ExtensionServiceConfig support.

talosctl gen removed subcommands

The following talosctl gen subcommands have been removed:

talosctl gen ca
talosctl gen crt
talosctl gen csr
talosctl gen key
talosctl gen keypair

These commands where historically used to generate pieces of Talos PKI, but they are no longer needed
as talosctl gen config and talosctl gen secrets now generate all required PKI material automatically.

Blank Virtual Machine Disks

A virtual machine disk can now be provisioned as an empty volume in a storage pool, rather than only
as a CD-ROM attached from a content library:

apiVersion: v1alpha1
kind: VirtualMachineConfig
name: vm1
disks:
  - name: data
    pool: pool1
    size: 100GiB
    format: qcow2
    provision:
      blank: {}

The pool must be declared by a StoragePool document in the same machine configuration; a disk
naming an undeclared pool is now a configuration error rather than a virtual machine that silently
never starts.

Four behaviours are worth knowing before you rely on this:

Volumes are adopted by name and are never deleted. The volume is named after the virtual
machine and the disk, so removing the disk from the configuration leaves the data in place, and
re-declaring the same virtual machine and disk names in the same pool reattaches it. Reclaiming
the space is a deliberate, out-of-band act. talosctl get storagepoolvolumestatuses lists
managed volumes, not retained orphan files: their statuses disappear when their requests and
consumers are gone. Inspect the pool's backing directory to discover retained files before
reclaiming space; confirm a file is no longer in use before deleting it.
Disks grow only. Raising size grows the volume the next time no virtual machine has it open,
because growing one underneath a running guest corrupts qcow2 metadata and is invisible to the
guest for raw. The pending growth is reported on the volume's status.
A smaller size is reported and ignored. Shrinking would truncate a filesystem the guest laid
out, so it is refused rather than applied; the disk stays attachable and the virtual machine keeps
running.
Remove all virtual machine references together with a StoragePool document. Removing a
referenced pool alone is rejected by configuration validation. Remove or update every virtual
machine referencing it in the same configuration change. During teardown, consumers release
the pool before it is undefined and its backing directory can be unmounted. The volume files
...

Assets 60

0 Join discussion

v1.13.11

github-actions released this 01 Oct 17:54

Immutable

v1.13.11

638bd94

Talos 1.13.11 (2026-10-01)

Welcome to the v1.13.11 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Time Check API

The TimeService/TimeCheck API (talosctl time --check) is no longer available to the os:reader role, as it allows querying
arbitrary time servers from the node. The TimeService/Time API (querying the configured time server) is still available to os:reader.

PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under /dev,
the name should start with ptp (e.g. /dev/ptp0, /dev/ptp_kvm), and the device should be a PTP character device.

Component Updates

Linux: 6.18.54
containerd: 2.2.9

Talos is built with Go 1.26.7

Contributors

Andrey Smirnov
Maja Bojarska
Noel Georgi
Raphaël DUCOM
Utku Ozdemir

Changes

13 commits

638bd9493 release(v1.13.11): prepare release
5f3e4fce3 test: fix up tests for default OCI spec
4fe094e73 fix: add validation for the PTP device name
56c81cffd fix: drop devices from the last observed generation if they are gone
bd7a2d4dc fix: perform stricter validation of hostnames/search domains
dbe8e022c fix: do not disclose pre-shared Wireguard key in LinkStatus
00db0af77 chore: pass kernel version down to VEX generator
500899185 fix: reconnect the WireGuard over gRPC tunnel after a failure
0077a50ed fix: drop logical links if they no longer declare as logical
29b1e6536 fix: notify about link alias changes
118a77363 fix(security): define the permissions the 6.18 kernel expects in the classes
365e3c4f6 fix: set TCP keealive and user timeout on apid proxied connections
080979b4c feat: update pkgs/tools

Changes from siderolabs/pkgs

10 commits

siderolabs/pkgs@642a01b feat: update containerd to 2.2.9
siderolabs/pkgs@3016b61 fix: add a patch to fix booting on Apple hardware
siderolabs/pkgs@889ec2b feat: update Linux to 6.18.54
siderolabs/pkgs@b554743 feat: update Linux to 6.18.53
siderolabs/pkgs@574809b feat: update DRBD & Linux firmware
siderolabs/pkgs@6f29f5d feat: update Linux to 6.18.52
siderolabs/pkgs@1737c02 feat: update Linux to 6.18.51
siderolabs/pkgs@6b76586 feat: update Linux to 6.18.50
siderolabs/pkgs@bb9fe70 feat: bump kernel to 6.18.49
siderolabs/pkgs@6187366 chore: sync tools

Changes from siderolabs/tools

2 commits

siderolabs/tools@b912600 feat: update pcre to 10.48
siderolabs/tools@7b95365 chore: bump util-linux 2.42.3

Dependency Changes

github.com/siderolabs/pkgs v1.13.0-65-g9b044c5 -> v1.13.0-75-g642a01b
github.com/siderolabs/talos/pkg/machinery v1.13.10 -> v1.13.11
github.com/siderolabs/tools v1.13.0-12-gc70be08 -> v1.13.0-14-gb912600

Previous release can be found at v1.13.10

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.11
ghcr.io/siderolabs/installer-base:v1.13.11
ghcr.io/siderolabs/imager:v1.13.11
ghcr.io/siderolabs/talos:v1.13.11
ghcr.io/siderolabs/talosctl-all:v1.13.11
ghcr.io/siderolabs/overlays:v1.13.11
ghcr.io/siderolabs/extensions:v1.13.11

Assets 60

0 Join discussion

v1.14.2 Latest

Latest

github-actions released this 29 Sep 20:44

Immutable

v1.14.2

f513c73

Talos 1.14.2 (2026-09-29)

Welcome to the v1.14.2 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Kubelet Resource Manager State

Talos now validates the kubelet CPU manager and memory manager state files (/var/lib/kubelet/cpu_manager_state, /var/lib/kubelet/memory_manager_state)
the same way kubelet does on startup, and removes a state file kubelet would refuse to load before starting kubelet.

Previously only a change of the manager policy was detected, so changing e.g. reservedSystemCPUs or reservedMemory, or
a change of the CPU/NUMA topology of the machine, left kubelet unable to start until the state file was removed manually.

Only the rendered KubeletConfiguration (machine.kubelet.extraConfig) is checked: the resource manager settings passed as kubelet
command line flags via machine.kubelet.extraArgs (e.g. --cpu-manager-policy, --reserved-cpus) are not taken into account.

Component Updates

Linux: 6.18.54
containerd: 2.3.6
runc: 1.5.2
Kubernetes: 1.37.1

Talos is built with Go 1.26.8.

Contributors

Andrey Smirnov
Jarrad S
Noel Georgi
Joakim Nohlgård
Karthik Chowdary
Loki San

Changes

20 commits

f513c7358 release(v1.14.2): prepare release
114c70ae3 feat: update Kubernetes default to 1.37.1
00a53e13d feat: update containerd to 2.3.6
305ced360 test: fix the md-boot pipeline
540a427c3 docs: clarify the KMS endpoint scheme
f53a00050 fix: drop devices from the last observed generation if they are gone
a015f8176 feat: handle the change in kubelet's CPU and memory policies
c792fa485 fix: perform stricter validation of hostnames/search domains
3137edfb0 fix: handle correctly routes without outlinkname set
e966b131d chore: clean up unused settings in LVM reconcile controllers
da3b328db fix: do not disclose pre-shared Wireguard key in LinkStatus
80fd649d1 fix: retry transient LVM reconciliation failures
98b3cb51e feat: add macsec module
949b85fa7 fix: preserve hostname under Docker (in container mode)
ad65799ab fix: handle Akamai/Linode metadata without IPv6
2e87819aa docs: clarify admission control and flannel config docs
a9422412d test: fix the aws-arm64 test
c7e25249d fix: use correct conditions on CRI <> sandboxd dependency
5a78c3fc3 fix: extend the USB settle code for more code paths
a8ac3ca50 feat: sync pkgs/tools

Changes from siderolabs/pkgs

12 commits

siderolabs/pkgs@6c312e4 fix: add a patch to fix booting on Apple hardware
siderolabs/pkgs@e1a76c7 feat: update Linux to 6.18.54, runc to 1.5.2
siderolabs/pkgs@3f054f6 feat: enable CONFIG_CRYPTO_ECC, CONFIG_CRYPTO_ECDH on arm64 to match amd64
siderolabs/pkgs@cc717ed feat: enable CONFIG_BLK_WBT
siderolabs/pkgs@cc32ceb feat: update containerd to 2.3.6
siderolabs/pkgs@b9f707f feat: update Linux to 6.18.53
siderolabs/pkgs@cf70858 fix: add missing sboms for swtpm
siderolabs/pkgs@7f22731 feat: enable CONFIG_MACSEC in the kernel
siderolabs/pkgs@3e199fb feat: add swtpm
siderolabs/pkgs@31af1a6 feat: update DRBD & Linux firmware
siderolabs/pkgs@612628d feat: update Linux to 6.18.52
siderolabs/pkgs@ed28ebb chore: sync tools with release-1.14

Changes from siderolabs/tools

1 commit

siderolabs/tools@9776960 feat: update pcre to 10.48

Dependency Changes

github.com/containerd/containerd/v2 v2.3.5 -> v2.3.6
github.com/siderolabs/pkgs v1.14.0-25-gf694e1b -> v1.14.0-37-g6c312e4
github.com/siderolabs/talos/pkg/machinery v1.14.1 -> v1.14.2
github.com/siderolabs/tools v1.14.0-7-ga404efb -> v1.14.0-8-g9776960
k8s.io/api v0.37.0 -> v0.37.1
k8s.io/apiextensions-apiserver v0.37.0 -> v0.37.1
k8s.io/apimachinery v0.37.0 -> v0.37.1
k8s.io/apiserver v0.37.0 -> v0.37.1
k8s.io/client-go v0.37.0 -> v0.37.1
k8s.io/component-base v0.37.0 -> v0.37.1
k8s.io/kube-proxy v0.37.0 -> v0.37.1
k8s.io/kube-scheduler v0.37.0 -> v0.37.1
k8s.io/kubectl v0.37.0 -> v0.37.1
k8s.io/kubelet v0.37.0 -> v0.37.1
k8s.io/pod-security-admission v0.37.0 -> v0.37.1
k8s.io/utils cf1189d6abe3 new

Previous release can be found at v1.14.1

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:3.7.1
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.1
registry.k8s.io/kube-controller-manager:v1.37.1
registry.k8s.io/kube-scheduler:v1.37.1
registry.k8s.io/kube-proxy:v1.37.1
ghcr.io/siderolabs/kubelet:v1.37.1
registry.k8s.io/networking/kube-network-policies:v1.1.1
ghcr.io/siderolabs/installer-base:v1.14.2
ghcr.io/siderolabs/imager:v1.14.2
ghcr.io/siderolabs/talos:v1.14.2
ghcr.io/siderolabs/talosctl-all:v1.14.2
ghcr.io/siderolabs/overlays:v1.14.2
ghcr.io/siderolabs/extensions:v1.14.2

Assets 60

cloud-images.json

sha256:2f09d1c72a7d3bd3f5cef1e58dfd0cd83e0cf06392e369b2df1a0c67c4429ea9

5.55 KB 2026-09-29T19:59:09Z
initramfs-amd64.xz

sha256:f3665c03faa3de32ab82acacd4452f87367a5f461f975e63bc295c5de3e41646

91.9 MB 2026-09-29T19:42:12Z
initramfs-amd64.xz.bundle

sha256:1643e03505bee78a240bf8b1eaeccc9f3ca84c4b00d0ece9ae29ba2aba8bed46

10.1 KB 2026-09-29T19:42:12Z
initramfs-arm64.xz

sha256:4c73d68a1463e715006d450bdf0e3800bbb94bbe5879765c08fb32abe662c880

82.7 MB 2026-09-29T19:42:12Z
initramfs-arm64.xz.bundle

sha256:1b8ca7e68bf5393e857b64c95967d3ca756f02f758efb9195cfa87ae953711b6

10.1 KB 2026-09-29T19:42:12Z
metal-amd64-uki.efi

sha256:1b9b8ef7979efc7bcf29293633d304721d5c181c3f6060261890988d5f3b4f80

111 MB 2026-09-29T19:42:12Z
metal-amd64-uki.efi.bundle

sha256:4cee37b47242377b5958b5776d8003f4a11c02f544201f52a808e1c415708738

10.1 KB 2026-09-29T19:42:12Z
metal-amd64.iso

sha256:293e824e6a14a0970edbce5a0dddc2bd204a711f326bd6a73df61b81a1a0df94

345 MB 2026-09-29T19:42:12Z
metal-amd64.iso.bundle

sha256:2832bff864d583e814b9564938f00ab03c703dd91a70a44b03b0354103cdc3a0

9.84 KB 2026-09-29T19:42:12Z
metal-amd64.raw.zst

sha256:d52c01c3d1ce2ee45ca508311c5604bfa9f6824491be98f5925142340bd7a2d0

220 MB 2026-09-29T19:42:12Z
Source code (zip)

2026-09-29T19:26:28Z
Source code (tar.gz)

2026-09-29T19:26:28Z
Release attestation (json)

2026-09-29T19:26:28Z

0 Join discussion

v1.14.1

github-actions released this 15 Sep 16:41

Immutable

v1.14.1

2f86b9d

Talos 1.14.1 (2026-09-15)

Welcome to the v1.14.1 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.51
containerd: 2.3.5

Talos is built with Go 1.26.8.

Contributors

Andrey Smirnov
Noel Georgi
Maja Bojarska
Utku Ozdemir
Aleksei Sviridkin
Brian Topping
Dennis Docter
Louis Deconinck
Mateusz Urbanek
Raphaël DUCOM
Sacha Weatherstone
leppeK
usman.malik_ext

Changes

36 commits

2f86b9d2a release(v1.14.1): prepare release
65f704ee1 chore: pass kernel version down to VEX generator
63101af5b fix: prevent sandboxd signal dispositions leaking into services
676276f72 test: peer passively with the MetalLB speaker
2b8b46dcd test: stop ARP flux breaking the BGP VRF test
357d6006a fix: rebuild the BGP server when its VRF is recreated
db0b5a17c fix: guard against nil config document slices
094741ff3 docs: clarify the kube-apiserver extra args and new config
a13b560f4 docs: correct the UnattendedInstallConfig name in the schema
166c4070c fix: make --insecure reachable for talosctl meta subcommands
aac106867 fix: ignore apply config dry-run for try mode
7a2c4e8cf fix: tighten the validation of v1alpha1 configs vs. migration
aef64fa38 fix: reconnect the WireGuard over gRPC tunnel after a failure
d07a21ad2 fix: drop logical links if they no longer declare as logical
9996bc871 fix: create GRUB bootloader ISOs only for BIOS
0604432de feat: add NixOS OVMF search path
5cb44dcab fix: wait for USB settle explicitly
20dcd515a fix: empty searchdomains dropped on merge
1e3e3fe50 chore: support correctly various disk types for the system disk
7c2e0b113 fix: notify about link alias changes
e9a67e163 chore: use the host page cache for the QEMU cluster disks
0afebca70 fix: use the final config version in upgrade-k8s
0ad18bb55 feat: bring in containerd 2.3.5
04c49d8a3 feat: allow generating an ECDSA service account key in secrets bundles
bb2cb91fc fix(security): define the permissions the 6.18 kernel expects in the classes
bf31b2811 fix: improve resilience of the action tracker against dropped conns
00a0ea03c fix: set TCP keealive and user timeout on apid proxied connections
6c065607e test: revert disabling PS/2 in QEMU
9841e0b47 docs: fix containerconfig.dependson examples
a11a260e6 feat: add USB LAN78XX drivers to the rootfs
9f8277434 fix: harden the code around kubelet's client certificate handling
3260b1e1f fix: resolve volume devices in shared selector helper
084152592 fix: create LVM physical volumes on the decrypted device
7dabdeb43 feat: add xfrm interface module
63963f7da feat: sync pkgs/tools
09681e895 fix: correct the bug with overlay assets in ESP being dropped

Changes from siderolabs/gen

2 commits

siderolabs/gen@cbd9518 chore: rekres and update deps
siderolabs/gen@26ccee1 feat: provide new YAMl unmarshal validator for null values

Changes from siderolabs/pkgs

10 commits

siderolabs/pkgs@f694e1b feat: update Linux to 6.18.51
siderolabs/pkgs@85a249a feat: update libpathrs to 0.2.6
siderolabs/pkgs@fe037b6 feat: update Linux to 6.18.50
siderolabs/pkgs@35e3898 feat: update containerd to 2.3.5
siderolabs/pkgs@fd0c2b2 fix: add a kernel patch for EFI SecureBoot integrity lockdown
siderolabs/pkgs@2415a01 feat: add kernel modules to enable Intel HD audio
siderolabs/pkgs@202a677 feat: bump kernel to 6.18.49
siderolabs/pkgs@5ddbb53 feat: enable CONFIG_USB_LAN78XX and CONFIG_MICROCHIP_PHY on amd64
siderolabs/pkgs@c61bcc3 feat: enable CONFIG_XFRM_INTERFACE in the kernel
siderolabs/pkgs@40ccb0d chore: sync tools & toolchain

Changes from siderolabs/tools

2 commits

siderolabs/tools@a404efb chore: bump util-linux 2.42.3
siderolabs/tools@3c49a3c feat: bump go to 1.26.8

Dependency Changes

github.com/containerd/containerd/v2 v2.3.4 -> v2.3.5
github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5
github.com/siderolabs/gen v0.8.7 -> v0.8.8
github.com/siderolabs/pkgs v1.14.0-15-g2f03590 -> v1.14.0-25-gf694e1b
github.com/siderolabs/talos/pkg/machinery v1.14.0 -> v1.14.1
github.com/siderolabs/tools v1.14.0-5-g87316ca -> v1.14.0-7-ga404efb

Previous release can be found at v1.14.0

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:3.7.1
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.0
registry.k8s.io/kube-controller-manager:v1.37.0
registry.k8s.io/kube-scheduler:v1.37.0
registry.k8s.io/kube-proxy:v1.37.0
ghcr.io/siderolabs/kubelet:v1.37.0
registry.k8s.io/networking/kube-network-policies:v1.1.1
ghcr.io/siderolabs/installer-base:v1.14.1
ghcr.io/siderolabs/imager:v1.14.1
ghcr.io/siderolabs/talos:v1.14.1
ghcr.io/siderolabs/talosctl-all:v1.14.1
ghcr.io/siderolabs/overlays:v1.14.1
ghcr.io/siderolabs/extensions:v1.14.1

Assets 60

0 Join discussion

v1.15.0-alpha.0 Pre-release

Pre-release

github-actions released this 08 Sep 13:04

Immutable

v1.15.0-alpha.0

12dfb8e

Talos 1.15.0-alpha.0 (2026-09-08)

Welcome to the v1.15.0-alpha.0 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

version 3	version 4
`[metrics]` `address`	`[plugins."io.containerd.server.v1.metrics"]` `address`
`[metrics]` `grpc_histogram`	`[plugins."io.containerd.metrics.v1.grpc-prometheus"]` `grpc_histogram`
`[grpc]` `address`, `uid`, `gid`, `max_recv_message_size`, `max_send_message_size`	`[plugins."io.containerd.server.v1.grpc"]` (same keys)
`[grpc]` `tcp_address`, `tcp_tls_ca`, `tcp_tls_cert`, `tcp_tls_key`, `tcp_tls_common_name`	`[plugins."io.containerd.server.v1.grpc-tcp"]` `address`, `tls_ca`, `tls_cert`, `tls_key`, `tls_common_name`
`[ttrpc]` `address`, `uid`, `gid`	`[plugins."io.containerd.server.v1.ttrpc"]` (same keys)
`[debug]` `address`, `uid`, `gid`	`[plugins."io.containerd.server.v1.debug"]` (same keys)

For example, the containerd metrics customization documented for previous versions of Talos:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [metrics]
    address = "0.0.0.0:11234"

should now be written as:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [plugins."io.containerd.server.v1.metrics"]
    address = "0.0.0.0:11234"

Unified --namespace Flag

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

talosctl image list also supports --namespace taloscontainers, to inspect images pulled for ContainerConfig containers. talosctl debug does not support the taloscontainers namespace.

Disk Free

A new talosctl diskfree command (aliased to df) reports storage and inode usage for mounted volumes.

Extension Service Configuration

ExtensionServiceConfig is supported only for extension services whose service manifest explicitly declares a configuration dependency:

depends:
  - configuration: true

IPVS Support

Following Kubernetes deprecation of IPVS support (kube-proxy), Talos Linux now ships IPVS as kernel modules which are not loaded by default.

If you require IPVS support, you can enable it by loading the following kernel modules:

ip_vs (core)
ip_vs_rr, ip_vs_wrr, ip_vs_lc, ip_vs_sh or ip_vs_mh (scheduling algorithms)
xt_ipvs (nftables/iptables match)

Kernel Log Extra Tags

The KmsgLogConfig document now supports an extraTags field which attaches additional key-value pairs
to every kernel log message sent to that destination:

apiVersion: v1alpha1
kind: KmsgLogConfig
name: apiSink
url: https://kmsglog.api/logs
extraTags:
  cluster: staging-west
  node: worker-1

Tags are scoped to the destination they are configured on, so different endpoints can receive different tags.
The keys facility, seq, clock, priority, msg, talos-time and talos-level are reserved and rejected,
as they are set by Talos itself.

KubeSpan Peer Endpoint Filters

KubeSpan now supports filtering the endpoints received from other peers via filters.peerEndpoints in the KubeSpanConfig document.

While filters.endpoints filters the addresses a node advertises to the whole cluster, filters.peerEndpoints filters the endpoints
received from other peers before the node connects to them, affecting only that node. This allows excluding peer-advertised endpoints
which are known to be unreachable from a node (e.g., addresses of a private network the node is not connected to), so that KubeSpan
endpoint rotation never attempts them.

Secure Boot images no longer have lockdown=confidentiality enabled by default

Secure Boot images no longer have lockdown=confidentiality enabled by default.
This change was made to improve compatibility with eBPF tooling under default schematic.
This means that Secure Boot images will now have lockdown=integrity enabled by default (implicitly), which is the recommended setting for most users.
Users can override it by adding lockdown=confidentiality to the kernel command line through Image Factory if they require it.

MACVLAN Links

Talos Linux now supports creating MACVLAN links with a new MacVLANConfig document:

apiVersion: v1alpha1
kind: MacVLANConfig
name: eth0.macvlan
parent: eth0
mode: bridge # optional, defaults to `bridge`
addresses:
  - address: 192.168.1.100/24

The source mode is not supported yet, as it requires a list of allowed source MAC addresses.

Multipath Configuration

The multipath-tools system extension now reads /etc/multipath.conf from the Talos host instead of using ExtensionServiceConfig.
The multipathd service waits for this file and bind-mounts it read-only into its service container.

Before updating the extension, apply a machine config patch that deletes the existing ExtensionServiceConfig document and adds an EtcFileConfig document:

apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: multipathd
$patch: delete
---
apiVersion: v1alpha1
kind: EtcFileConfig
name: multipath.conf
mode: 0o644
contents: |
  defaults {
      user_friendly_names yes
      find_multipaths no
      path_selector "round-robin 0"
  }

The extension does not provide a default configuration, so multipathd remains waiting until /etc/multipath.conf is present.

Component Updates

Linux: 6.18.49
Kubernetes: 1.37.0
containerd: 2.3.5
CoreDNS: 1.14.7

Talos is built with Go 1.26.8.

VXLAN Links

Talos Linux now supports creating VXLAN links with a new VXLANConfig document:

apiVersion: v1alpha1
kind: VXLANConfig
name: vxlan100
id: 100 # VXLAN network identifier (VNI)
parent: eth0
local: 10.255.0.1 # or `group:` for a multicast group, but not both
port: 4789 # optional, defaults to 4789
learning: false # optional, defaults to true
addresses:
  - address: 192.168.1.100/24

Contributors

Andrey Smirnov
Maja Bojarska
Noel Georgi
Mateusz Urbanek
Dmitrii Sharshakov
Utku Ozdemir
Loki San
Max Makarov
Sacha Weatherstone
Dennis Docter
Dima Aratin
Evan Champion
Ivan Demchuk
Kamil Szczygieł
Kuzia
Licia Seiker
MsfPablo
Noel
Orzelius
Oscar Wieman
Raphaël DUCOM
Spencer Smith
Steve Francis
Winter
dadbravo
neiltalap
usman.malik_ext

Changes

120 commits

12dfb8e1a release(v1.15.0-alpha.0): prepare release
f3017d31e fix: add missing extension test patches for nfs
67ae852a9 fix: wait for USB settle explicitly
274dc8581 fix(security): define the permissions the 6.18 kernel expects in the classes
28841f4c4 fix: empty searchdomains dropped on merge
5a67d1e8e chore: support correctly various disk types for the system disk
834ba888a fix: improve resilience of the action tracker against dropped conns
a2d35a90c fix: notify about link alias changes
9de219cfb test: nvidia - switch to nri
24ef6f436 fix: use the final config version in upgrade-k8s
a1ec9d567 docs: update CODE_OF_CONDUCT.md
6a8b836f2 fix: set TCP keealive and user timeout on apid proxied connections
607ee15c9 chore: use the host page cache for the QEMU cluster disks
a6bde65fd feat: allow generating an ECDSA service account key in secrets bundles
ecb012883 feat: update containerd to 2.3.5
54204560c feat: bump to containerd config version 4
a42ea1d4a feat: add KubeSpan peer endpoint filters
0bd0cc8fc fix: ensure lockdown integrity in SecureBoot mode
7eb4e75c1 feat: add KmsgLogConfig extraTags support
01ebf95a0 feat: add VXLAN interface configuration support
019b5f432 feat: add macvlan interface configuration support...

Assets 60

0 Join discussion

v1.12.12

github-actions released this 04 Sep 15:50

Immutable

v1.12.12

a58adaa

Talos 1.12.12 (2026-09-04)

Welcome to the v1.12.12 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.49
Containerd: 2.2.7
Flannel: 0.28.9
Etcd: v3.6.14
Kubernetes: v1.35.8

Talos is built with Go 1.25.14.

Contributors

Noel Georgi
Andrey Smirnov
Mateusz Urbanek
immanuwell

Changes

13 commits

a58adaabd release(v1.12.12): prepare release
5f22763ef feat: bump dependencies
f0ef9c13b fix: harden the code around kubelet's client certificate handling
c4612c44e fix: filter out passed metadata in API proxying
c7ac6acf8 fix: treat desired roles empty as error in Talos API access
4615df421 fix: create parent directories when extracting tar archives
1d685ff4e fix: use os.Root in the talosctl extract path
227390bc5 fix: escape output in the talosctl dashboard
3d4cb876a fix: add checks for meta key in the API path
8b3b65027 chore: reduce verbosity of the grype scan
1eb7caf6e fix: preserve special modes when extracting files
f9a8d4324 fix: use os.Root in the untar path
763c4e4cd fix: don't set xattrs while decompressing extensions

Changes from siderolabs/pkgs

10 commits

siderolabs/pkgs@5eb9201 chore: rekres
siderolabs/pkgs@8f2f189 feat: support confiuring gnu mirror urls
siderolabs/pkgs@0c89ae0 feat: bump linux-firmware to 20260810
siderolabs/pkgs@eb4a8dc feat: bump flannel to v1.9.1-flannel3
siderolabs/pkgs@ce90bd5 feat: bump containerd to 2.2.7
siderolabs/pkgs@935b8b2 feat: bump go to 1.25.14
siderolabs/pkgs@13cf7a6 feat: bump kernel to 6.18.49
siderolabs/pkgs@449db13 feat: update kernel to 6.18.48
siderolabs/pkgs@3584845 feat: bump kernel to 6.18.47
siderolabs/pkgs@122c8d2 feat: bump kernel to 6.18.46

Changes from siderolabs/tools

4 commits

siderolabs/tools@6c999e3 fix: fakeroot url
siderolabs/tools@5aeec5b feat: use kernel gnu mirrors
siderolabs/tools@5fcfa57 feat: bump go to 1.25.14
siderolabs/tools@89d3bee fix: update OpenSSL to 3.6.4

Dependency Changes

github.com/insomniacslk/dhcp 175e84fbb167 -> c308df0fdcef
github.com/siderolabs/pkgs v1.12.0-103-gf921142 -> v1.12.0-113-g5eb9201
github.com/siderolabs/talos/pkg/machinery v1.12.11 -> v1.12.12
github.com/siderolabs/tools v1.12.0-20-g7a5d6da -> v1.12.0-24-g6c999e3
github.com/sirupsen/logrus v1.9.3 -> v1.9.4
go.etcd.io/etcd/api/v3 v3.6.11 -> v3.6.14
go.etcd.io/etcd/client/pkg/v3 v3.6.11 -> v3.6.14
go.etcd.io/etcd/client/v3 v3.6.11 -> v3.6.14
go.etcd.io/etcd/etcdutl/v3 v3.6.11 -> v3.6.14
golang.org/x/net v0.57.0 -> v0.58.0
golang.org/x/text v0.40.0 -> v0.41.0
google.golang.org/grpc v1.82.1 -> v1.83.1
google.golang.org/protobuf v1.36.11 -> f2248ac996af
k8s.io/api v0.35.4 -> v0.35.8
k8s.io/apiextensions-apiserver v0.35.4 -> v0.35.8
k8s.io/apimachinery v0.35.4 -> v0.35.8
k8s.io/apiserver v0.35.4 -> v0.35.8
k8s.io/client-go v0.35.4 -> v0.35.8
k8s.io/component-base v0.35.4 -> v0.35.8
k8s.io/cri-api v0.35.4 -> v0.35.8
k8s.io/kube-scheduler v0.35.4 -> v0.35.8
k8s.io/kubectl v0.35.4 -> v0.35.8
k8s.io/kubelet v0.35.4 -> v0.35.8
k8s.io/pod-security-admission v0.35.4 -> v0.35.8

Previous release can be found at v1.12.11

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/kube-apiserver:v1.35.8
registry.k8s.io/kube-controller-manager:v1.35.8
registry.k8s.io/kube-scheduler:v1.35.8
registry.k8s.io/kube-proxy:v1.35.8
ghcr.io/siderolabs/kubelet:v1.35.8
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.12
ghcr.io/siderolabs/installer-base:v1.12.12
ghcr.io/siderolabs/imager:v1.12.12
ghcr.io/siderolabs/talos:v1.12.12
ghcr.io/siderolabs/talosctl-all:v1.12.12
ghcr.io/siderolabs/overlays:v1.12.12
ghcr.io/siderolabs/extensions:v1.12.12

Assets 60

3 Join discussion

v1.14.0

github-actions released this 03 Sep 07:26

Immutable

v1.14.0

9abd05a

Talos 1.14.0 (2026-09-03)

Welcome to the v1.14.0 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the ResolverConfig document, allowing for flexible configuration of DNS resolution.

Apply Configuration Modes

The '--mode=reboot' option has been removed from the talosctl apply-config command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.

Native BGP

Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with BGPInstanceConfig documents.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

Added repeatable, named BGPInstanceConfig documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (routeSource).
Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set installRoutes: false to retain learned routes in the BGP RIB without installing them into the Linux routing table.
Instances can selectively import best neighbor-learned routes from other named instances with importRoutes prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
Peer state is observable via instance-qualified BGPPeerStatus resources (talosctl get bgppeerstatus).
RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.

Btrfs Support

Talos now supports mounting and provisioning btrfs filesystem for user volumes and existing volumes.

Support for btrfs is enabled by installing btrfs system extension.

Unified --namespace Flag

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

talosctl image list also supports --namespace taloscontainers, to inspect images pulled for ContainerConfig containers. talosctl debug does not support the taloscontainers namespace.

CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
CRIBaseRuntimeSpecConfig document:

apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024

The .machine.baseRuntimeSpecOverrides field is deprecated and remains supported during the deprecation
period. It is mutually exclusive with CRIBaseRuntimeSpecConfig; configurations containing both are rejected.

Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI
automatically. A machine reboot is no longer required.

CRI Customization Configuration

Talos now supports customizing the CRI containerd configuration with named CRICustomizationConfig
documents. Each document contains a TOML fragment; fragments are merged in lexicographical order by name.
Applying, updating, or removing these documents updates the generated CRI configuration and restarts CRI
automatically.

The legacy /etc/cri/conf.d/20-customization.part machine-file configuration remains supported during the
deprecation period and is exposed under the reserved name customization. A CRICustomizationConfig document
cannot use that name.

NOTE: a machine reboot is no longer required to apply changes to CRI configuration.

Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, add the following machine configuration document:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true

Default Installer Image

The default installer image has been updated to use the Image Factory.
The ghcr.io/siderolabs/installer image is no longer published with releases; use the Image Factory installer image instead.

DHCP

DHCPv4 search domains are now applied to the resolver configuration.

DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers.

Cluster Discovery

Talos introduces support for configuring multiple discovery service endpoints.
Talos introduces new document for configuring the cluster discovery identity.

List of changes:

Deprecated .cluster.discovery in the v1alpha1 config; use the DiscoveryServiceConfig document for discovery service configuration. The v1alpha1 config and DiscoveryServiceConfig are mutually exclusive.
Deprecated .cluster.secret and cluster.id in the v1alpha1 config; use the DiscoveryIdentityConfig document for discovery identity configuration. The v1alpha1 config and DiscoveryIdentityConfig are mutually exclusive.
Changed cluster ID encoding in the generated secret bundle, from base64.URLEncoding to base64.StdEncoding. This aligns the encoding with the rest of Talos.

Encryption Discards

Volume encryption now supports an allowDiscards option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.

etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

etcd now serves its HTTP-only endpoints (/metrics, /health, the gRPC-gateway JSON API) on a dedicated
listener on port 2383, while the client port 2379 serves gRPC only. This keeps gRPC off Go's net/http
HTTP/2 server, avoiding watch-stream starvation under TLS (see etcd-io/etcd#15402, golang/go#58804,
etcd-io/etcd#21605).

Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on 2379; scrape them on
port 2383 instead (same client mTLS as before). etcd gRPC clients and the Talos health check are unaffected.

Firewall might need to be adjusted to block the port 2383 if previously 2379 was blocked.

If --listen-metrics-urls was customized, the metrics should not move.

EtcFileConfig

Talos now supports managing user-owned files under /etc with the new EtcFileConfig multi-document
configuration kind. The document name is the path relative to /etc, and each document owns the complete
file contents and mode.

This can be used to configure files such as /etc/nfsmount.conf or /etc/multipath.conf. Talos-managed
paths, including resolv.conf, hosts, machine-id, CRI and Kubernetes configuration, trust bundles, and
identity files, are rejected to prevent overriding files owned by Talos.

Extension Service Configuration

ExtensionServiceConfig is supported only for extension services whose service manifest explicitly declares a configuration dependency:

depends:
  - configuration: true

Filesystem Trim

Talos can now periodically trim (the equivalent of the fstrim command) mounted filesystems which support trimming,
discarding unused blocks. This is useful for SSDs and thin-provisioned storage.

Trimming is opt-in via a new FilesystemTrimConfig document which sets the global trim interval:

apiVersion: v1alpha1
kind: FilesystemTrimConfig
interval: 168h0m0s # one week

The default machine configuration for Talos 1.14+ includes a FilesystemTrimConfig document with a default trim interval of one week,
so trimming is enabled by default for eligible filesystems. For cluster which were upgraded from older versions, the FilesystemTrimConfig document will be missing,
so trimming will be disabled by default until the document is added.

When the...

Assets 60

0 Join discussion

v1.13.10

github-actions released this 03 Sep 19:04

Immutable

v1.13.10

00ca4c9

Talos 1.13.10 (2026-09-03)

Welcome to the v1.13.10 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.48
CoreDNS: 1.14.7

Talos is built with Go 1.26.7

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi
Dima Aratin
Ivan Demchuk
Maja Bojarska
Max Makarov
Utku Ozdemir
immanuwell

Changes

28 commits

00ca4c987 release(v1.13.10): prepare release
271ce0dc8 fix: update DHCP library
3c70f4054 fix: harden the code around kubelet's client certificate handling
40d7de4c0 fix: normalize image reference when passing to image verification flow
cf30d6df4 fix: filter out passed metadata in API proxying
cc556d9ce fix: treat desired roles empty as error in Talos API access
0d7a47305 fix: allow CSI volumes to be mounted with an SELinux context
17ab196fe fix: validate received kubeconfig
934ae8a2b chore: update etcd to v3.6.14
df9b82dce chore: update pkgs and tools
591c53aac fix: use os.Root in the talosctl extract path
c36d99001 fix: escape output in the talosctl dashboard
fc355dcd3 fix: add checks for meta key in the API path
e950f655e feat: update COSI to 1.16.3
20cafbdb3 fix: route creation churning every 100ms
c6fe78c61 chore: reduce verbosity of the grype scan
b9696f9d7 fix: preserve special modes when extracting files
865aaec80 fix: use os.Root in the untar path
097fa184e fix: create parent directories when extracting tar archives
c6edc3911 chore: bump sigstore/rekor to v1.5.4
6d062e13b fix: write the uploaded etcd snapshot atomically
f6b795970 fix: skip selinux label for read-only/detached/external mounts
bea850ac3 fix: persist in-memory meta on fresh install
dcf46c11e fix: reduce stalls in the etcd member promotion cycle
0f4d08a1f feat: update CoreDNS to 1.14.7
e0916388e fix: watch IPv6 route changes in RouteSpecController
92614ca8a fix: truncate files replaced by system extensions
b7b27ec29 fix: skip target settings for external volume mounts

Changes from siderolabs/pkgs

5 commits

siderolabs/pkgs@9b044c5 feat: update kernel to 6.18.48
siderolabs/pkgs@de74a50 feat: bump kernel to 6.18.47
siderolabs/pkgs@bb15c62 chore: update toolchain and tools
siderolabs/pkgs@49c50f7 feat: bump kernel to 6.18.46
siderolabs/pkgs@2da2cdc feat: backport aes256k support (Ceph)

Changes from siderolabs/tools

3 commits

siderolabs/tools@c70be08 chore: update toolchain
siderolabs/tools@7791f48 feat: use kernel gnu mirrors
siderolabs/tools@d908dc0 fix: update OpenSSL to 3.6.4

Dependency Changes

github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 -> v1.22.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
github.com/aws/aws-sdk-go-v2 v1.41.7 -> v1.43.0
github.com/aws/aws-sdk-go-v2/config v1.32.17 -> v1.32.31
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 -> v1.18.31
github.com/aws/aws-sdk-go-v2/service/kms v1.52.0 -> v1.55.0
github.com/aws/smithy-go v1.25.1 -> v1.27.3
github.com/cosi-project/runtime v1.14.1 -> v1.16.3
github.com/docker/cli v29.4.3 -> v29.5.3
github.com/fatih/color v1.18.0 -> v1.19.0
github.com/google/go-containerregistry v0.21.6 -> v0.21.7
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 -> v2.3.4
github.com/insomniacslk/dhcp 5adc3eb26f91 -> 234b97448fae
github.com/klauspost/compress v1.18.7 -> v1.19.2
github.com/mattn/go-isatty v0.0.20 -> v0.0.24
github.com/prometheus/procfs v0.20.1 -> v0.22.0
github.com/siderolabs/pkgs v1.13.0-60-gf541ca4 -> v1.13.0-65-g9b044c5
github.com/siderolabs/talos/pkg/machinery v1.13.9 -> v1.13.10
github.com/siderolabs/tools v1.13.0-9-ga201d19 -> v1.13.0-12-gc70be08
github.com/sigstore/sigstore v1.10.8 -> v1.10.9
github.com/sirupsen/logrus v1.9.4 -> v1.10.2
github.com/stretchr/testify v1.11.1 -> v1.12.1
go.etcd.io/etcd/api/v3 v3.6.12 -> v3.6.14
go.etcd.io/etcd/client/pkg/v3 v3.6.12 -> v3.6.14
go.etcd.io/etcd/client/v3 v3.6.12 -> v3.6.14
go.etcd.io/etcd/etcdutl/v3 v3.6.12 -> v3.6.14
go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
google.golang.org/grpc v1.82.1 -> v1.83.2
google.golang.org/protobuf f2248ac996af -> v1.36.12

Previous release can be found at v1.13.9

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.10
ghcr.io/siderolabs/installer-base:v1.13.10
ghcr.io/siderolabs/imager:v1.13.10
ghcr.io/siderolabs/talos:v1.13.10
ghcr.io/siderolabs/talosctl-all:v1.13.10
ghcr.io/siderolabs/overlays:v1.13.10
ghcr.io/siderolabs/extensions:v1.13.10

Assets 60

1 Join discussion

v1.14.0-rc.2 Pre-release

Pre-release

github-actions released this 25 Aug 08:57

Immutable

v1.14.0-rc.2

414a1d4

Talos 1.14.0-rc.2 (2026-08-25)

Welcome to the v1.14.0-rc.2 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Apply Configuration Modes

Native BGP

List of changes:

Added repeatable, named BGPInstanceConfig documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (routeSource).
Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set installRoutes: false to retain learned routes in the BGP RIB without installing them into the Linux routing table.
Instances can selectively import best neighbor-learned routes from other named instances with importRoutes prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
Peer state is observable via instance-qualified BGPPeerStatus resources (talosctl get bgppeerstatus).
RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.

Btrfs Support

Talos now supports mounting and provisioning btrfs filesystem for user volumes and existing volumes.

Support for btrfs is enabled by installing btrfs system extension.

CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
CRIBaseRuntimeSpecConfig document:

apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024

Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI
automatically. A machine reboot is no longer required.

CRI Customization Configuration

NOTE: a machine reboot is no longer required to apply changes to CRI configuration.

Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, add the following machine configuration document:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true

Default Installer Image

The default installer image has been updated to use the Image Factory.
The ghcr.io/siderolabs/installer image is no longer published with releases; use the Image Factory installer image instead.

DHCP

DHCPv4 search domains are now applied to the resolver configuration.

DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers.

Cluster Discovery

Talos introduces support for configuring multiple discovery service endpoints.
Talos introduces new document for configuring the cluster discovery identity.

List of changes:

Deprecated .cluster.discovery in the v1alpha1 config; use the DiscoveryServiceConfig document for discovery service configuration. The v1alpha1 config and DiscoveryServiceConfig are mutually exclusive.
Deprecated .cluster.secret and cluster.id in the v1alpha1 config; use the DiscoveryIdentityConfig document for discovery identity configuration. The v1alpha1 config and DiscoveryIdentityConfig are mutually exclusive.
Changed cluster ID encoding in the generated secret bundle, from base64.URLEncoding to base64.StdEncoding. This aligns the encoding with the rest of Talos.

Encryption Discards

Volume encryption now supports an allowDiscards option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.

etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

Firewall might need to be adjusted to block the port 2383 if previously 2379 was blocked.

If --listen-metrics-urls was customized, the metrics should not move.

EtcFileConfig

Filesystem Trim

Talos can now periodically trim (the equivalent of the fstrim command) mounted filesystems which support trimming,
discarding unused blocks. This is useful for SSDs and thin-provisioned storage.

Trimming is opt-in via a new FilesystemTrimConfig document which sets the global trim interval:

apiVersion: v1alpha1
kind: FilesystemTrimConfig
interval: 168h0m0s # one week

When the document is present, Talos builds a stable schedule (hashed by node ID and volume ID, so trims are spread out
across volumes and across nodes in a cluster) and trims eligible volumes (ready disk/partition volumes with a
trim-capable filesystem; for encrypted volumes only when allowDiscards is set).

The trim interval can be overridden or disabled per-volume via a trim block on the volume documents
(VolumeConfig, UserVolumeConfig, ExistingVolumeConfig, ExternalVolumeConfig):

trim:
  enabled: true
  interval: 24h0m0s

Flannel CNI

Talos now configures Flannel with the EnableNFTables option enabled, which uses nftables native backend instead of iptables-nft compatibility layer.

FlexVolume Host Path Removed

Talos no longer provisions the deprecated FlexVolume executable host path at
/usr/libexec/kubernetes. FlexVolume has been deprecated since Kubernetes 1.23.
Modern CSI plugin paths under /var/lib/kubelet are unaffected.

Host DNS Configuration

HostDNS configuration was moved from the v1alpha1 config .machine.features.hostDNS field to the new hostDNS in the ResolverConfig document.

HTTP Probe Support

...

Assets 60

0 Join discussion

v1.13.9

github-actions released this 19 Aug 08:03

Immutable

v1.13.9

3ebd10a

Talos 1.13.9 (2026-08-19)

Welcome to the v1.13.9 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.44
containerd: 2.2.7
Kubernetes: 1.36.3

Talos is built with Go 1.26.6.

Contributors

Andrey Smirnov
Noel Georgi

Changes

7 commits

3ebd10a7c release(v1.13.9): prepare release
9ade215ce feat: update Kubernetes to 1.36.3
14343cd29 test: save the provision test logs
b33e5fce2 fix: support try mode apply without prior config
6a8f29591 fix: share IPC namespace with the host for extension services
b525b8290 fix: size the receive/send buffers for nftables netlink
7ac52642c feat: update Go to 1.26.6

Changes from siderolabs/pkgs

5 commits

siderolabs/pkgs@f541ca4 feat: bump kernel to 6.18.44
siderolabs/pkgs@a4f2c26 feat: bump kernel to 6.18.43
siderolabs/pkgs@79a7531 feat: update Linux firmware to 20260810
siderolabs/pkgs@89d76bf feat: update backportable dependencies
siderolabs/pkgs@af6c08a feat: update Go to 1.26.6

Changes from siderolabs/tools

1 commit

siderolabs/tools@a201d19 feat: update Go to 1.26.6

Dependency Changes

github.com/siderolabs/pkgs v1.13.0-55-gf677246 -> v1.13.0-60-gf541ca4
github.com/siderolabs/talos/pkg/machinery v1.13.8 -> v1.13.9
github.com/siderolabs/tools v1.13.0-8-gc2844e6 -> v1.13.0-9-ga201d19
golang.org/x/net v0.57.0 -> v0.58.0
golang.org/x/text v0.40.0 -> v0.41.0
k8s.io/api v0.36.2 -> v0.36.3
k8s.io/apiextensions-apiserver v0.36.2 -> v0.36.3
k8s.io/apimachinery v0.36.2 -> v0.36.3
k8s.io/apiserver v0.36.2 -> v0.36.3
k8s.io/client-go v0.36.2 -> v0.36.3
k8s.io/component-base v0.36.2 -> v0.36.3
k8s.io/cri-api v0.36.2 -> v0.36.3
k8s.io/kube-scheduler v0.36.2 -> v0.36.3
k8s.io/kubectl v0.36.2 -> v0.36.3
k8s.io/kubelet v0.36.2 -> v0.36.3
k8s.io/pod-security-admission v0.36.2 -> v0.36.3

Previous release can be found at v1.13.8

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.6
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.9
ghcr.io/siderolabs/installer-base:v1.13.9
ghcr.io/siderolabs/imager:v1.13.9
ghcr.io/siderolabs/talos:v1.13.9
ghcr.io/siderolabs/talosctl-all:v1.13.9
ghcr.io/siderolabs/overlays:v1.13.9
ghcr.io/siderolabs/extensions:v1.13.9

Assets 60

0 Join discussion

Releases: siderolabs/talos

Release list

v1.15.0-alpha.1

Talos 1.15.0-alpha.1 (2026-10-13)

Boot Partition Wait

containerd Configuration Version 4

Unified --namespace Flag

CPU Scaling Configuration

Disk SMART Status

Disk Free

Extension Service Configuration

talosctl gen removed subcommands

Blank Virtual Machine Disks

Uh oh!

v1.13.11

Talos 1.13.11 (2026-10-01)

Time Check API

Component Updates

Contributors

Changes

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

Images

Uh oh!

v1.14.2

Talos 1.14.2 (2026-09-29)

Kubelet Resource Manager State

Component Updates

Contributors

Changes

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

Images

Uh oh!

v1.14.1

Talos 1.14.1 (2026-09-15)

Component Updates

Contributors

Changes

Changes from siderolabs/gen

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

Images

Uh oh!

v1.15.0-alpha.0

Talos 1.15.0-alpha.0 (2026-09-08)

containerd Configuration Version 4

Unified --namespace Flag

Disk Free

Extension Service Configuration

IPVS Support

Kernel Log Extra Tags

KubeSpan Peer Endpoint Filters

Secure Boot images no longer have lockdown=confidentiality enabled by default

MACVLAN Links

Multipath Configuration

Component Updates

VXLAN Links

Contributors

Changes

Uh oh!

v1.12.12

Talos 1.12.12 (2026-09-04)

Component Updates

Contributors

Changes

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

Images

Uh oh!

v1.14.0

Talos 1.14.0 (2026-09-03)

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Apply Configuration Modes

Native BGP

Btrfs Support