chore(deps): update dependency siderolabs/talos to v1.14.4 #237
No reviewers
Labels
No labels
No milestone
No assignees
1 participant
sheogorath
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
shivering-isles/infrastructure-gitops!237
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/siderolabs-talos-1.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v1.13.9→v1.14.4v1.13.7→v1.14.4v1.13.8→v1.14.4Release Notes
siderolabs/talos
v1.14.4Compare Source
Talos 1.14.4 (2026-10-16)
Welcome to the v1.14.4 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.57
Talos is built with Go 1.26.9.
Contributors
Changes
1 commit
3fb46c3release(v1.14.4): prepare releaseChanges from siderolabs/pkgs
2 commits
2ec10ebchore: update DRBD compat643b731feat: update Linux to 6.18.57Dependency Changes
Previous release can be found at v1.14.3
Images
v1.14.3Compare Source
Talos 1.14.3 (2026-10-15)
Welcome to the v1.14.3 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Time Check API
The
TimeService/TimeCheckAPI (talosctl time --check) is no longer available to theos:readerrole, as it allows queryingarbitrary time servers from the node. The
TimeService/TimeAPI (querying the configured time server) is still available toos:reader.PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under
/dev,the name should start with
ptp(e.g./dev/ptp0,/dev/ptp_kvm), and the device should be a PTP character device.Component Updates
Linux: 6.18.56
containerd: 2.3.7
etcd: 3.7.2
Talos is built with Go 1.26.9.
Contributors
Changes
17 commits
68da63frelease(v1.14.3): prepare releasecbe3449fix: disable GSO offload on QEMU 10.2+1e3f3adtest: adapt minimal settings to new QEMU version59e1fcdfix: restrict raw disk helper to linux08b2136fix: make the imager installer reproducible with system extensionsa9b984afix: improve KubePrism load balancer recoveryd015381fix: clean up mountpoints on unmount146c2bdfix: roll back stacked try configs to the config before the first tryf518223fix: correct handling of DHCP changing addressf97d79ffix: image verification test5fadce7fix: verify the claim for the legacy bundle image verification6cade9ffix: restore source names for pseudo filesystem mounts692e679fix: add validation for the PTP device nameb166b72fix: network on azure (and might fix some other platforms)4c4e57afeat: update etcd to 3.7.20d3b40cfeat: update tools and pkgs51d094ffix: tear down stale routes before adding their replacementsChanges from siderolabs/pkgs
5 commits
5fa47d1feat: update to containerd 2.3.76873154feat: update Linux to 6.18.56ecd53d0feat: enable pNFS block and SCSI layouts in nfsd473b20cfeat: enable bhyve guest support on amd64f3add0cfeat: enable Qualcomm Cloud AI 100 (QAIC) driverChanges from siderolabs/tools
1 commit
6b71647feat: update Go to 1.26.9Dependency Changes
Previous release can be found at v1.14.2
Images
v1.14.2Compare Source
Talos 1.14.2 (2026-09-29)
Welcome to the v1.14.2 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Kubelet Resource Manager State
Talos now validates the kubelet CPU manager and memory manager state files (
/var/lib/kubelet/cpu_manager_state,/var/lib/kubelet/memory_manager_state)the same way kubelet does on startup, and removes a state file kubelet would refuse to load before starting kubelet.
Previously only a change of the manager policy was detected, so changing e.g.
reservedSystemCPUsorreservedMemory, ora change of the CPU/NUMA topology of the machine, left kubelet unable to start until the state file was removed manually.
Only the rendered
KubeletConfiguration(machine.kubelet.extraConfig) is checked: the resource manager settings passed as kubeletcommand line flags via
machine.kubelet.extraArgs(e.g.--cpu-manager-policy,--reserved-cpus) are not taken into account.Component Updates
Linux: 6.18.54
containerd: 2.3.6
runc: 1.5.2
Kubernetes: 1.37.1
Talos is built with Go 1.26.8.
Contributors
Changes
20 commits
f513c73release(v1.14.2): prepare release114c70afeat: update Kubernetes default to 1.37.100a53e1feat: update containerd to 2.3.6305ced3test: fix the md-boot pipeline540a427docs: clarify the KMS endpoint schemef53a000fix: drop devices from the last observed generation if they are gonea015f81feat: handle the change in kubelet's CPU and memory policiesc792fa4fix: perform stricter validation of hostnames/search domains3137edffix: handle correctly routes without outlinkname sete966b13chore: clean up unused settings in LVM reconcile controllersda3b328fix: do not disclose pre-shared Wireguard key in LinkStatus80fd649fix: retry transient LVM reconciliation failures98b3cb5feat: add macsec module949b85ffix: preserve hostname under Docker (in container mode)ad65799fix: handle Akamai/Linode metadata without IPv62e87819docs: clarify admission control and flannel config docsa942241test: fix the aws-arm64 testc7e2524fix: use correct conditions on CRI <> sandboxd dependency5a78c3ffix: extend the USB settle code for more code pathsa8ac3cafeat: sync pkgs/toolsChanges from siderolabs/pkgs
12 commits
6c312e4fix: add a patch to fix booting on Apple hardwaree1a76c7feat: update Linux to 6.18.54, runc to 1.5.23f054f6feat: enable CONFIG_CRYPTO_ECC, CONFIG_CRYPTO_ECDH on arm64 to match amd64cc717edfeat: enable CONFIG_BLK_WBTcc32cebfeat: update containerd to 2.3.6b9f707ffeat: update Linux to 6.18.53cf70858fix: add missing sboms for swtpm7f22731feat: enable CONFIG_MACSEC in the kernel3e199fbfeat: add swtpm31af1a6feat: update DRBD & Linux firmware612628dfeat: update Linux to 6.18.52ed28ebbchore: sync tools with release-1.14Changes from siderolabs/tools
1 commit
9776960feat: update pcre to 10.48Dependency Changes
cf1189dnewPrevious release can be found at v1.14.1
Images
v1.14.1Compare Source
Talos 1.14.1 (2026-09-15)
Welcome to the v1.14.1 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.51
containerd: 2.3.5
Talos is built with Go 1.26.8.
Contributors
Changes
36 commits
2f86b9drelease(v1.14.1): prepare release65f704echore: pass kernel version down to VEX generator63101affix: prevent sandboxd signal dispositions leaking into services676276ftest: peer passively with the MetalLB speaker2b8b46dtest: stop ARP flux breaking the BGP VRF test357d600fix: rebuild the BGP server when its VRF is recreateddb0b5a1fix: guard against nil config document slices094741fdocs: clarify the kube-apiserver extra args and new configa13b560docs: correct the UnattendedInstallConfig name in the schema166c407fix: make --insecure reachable for talosctl meta subcommandsaac1068fix: ignore apply config dry-run for try mode7a2c4e8fix: tighten the validation of v1alpha1 configs vs. migrationaef64fafix: reconnect the WireGuard over gRPC tunnel after a failured07a21afix: drop logical links if they no longer declare as logical9996bc8fix: create GRUB bootloader ISOs only for BIOS0604432feat: add NixOS OVMF search path5cb44dcfix: wait for USB settle explicitly20dcd51fix: empty searchdomains dropped on merge1e3e3fechore: support correctly various disk types for the system disk7c2e0b1fix: notify about link alias changese9a67e1chore: use the host page cache for the QEMU cluster disks0afebcafix: use the final config version in upgrade-k8s0ad18bbfeat: bring in containerd 2.3.504c49d8feat: allow generating an ECDSA service account key in secrets bundlesbb2cb91fix(security): define the permissions the 6.18 kernel expects in the classesbf31b28fix: improve resilience of the action tracker against dropped conns00a0ea0fix: set TCP keealive and user timeout on apid proxied connections6c06560test: revert disabling PS/2 in QEMU9841e0bdocs: fix containerconfig.dependson examplesa11a260feat: add USB LAN78XX drivers to the rootfs9f82774fix: harden the code around kubelet's client certificate handling3260b1efix: resolve volume devices in shared selector helper0841525fix: create LVM physical volumes on the decrypted device7dabdebfeat: add xfrm interface module63963f7feat: sync pkgs/tools09681e8fix: correct the bug with overlay assets in ESP being droppedChanges from siderolabs/gen
2 commits
cbd9518chore: rekres and update deps26ccee1feat: provide new YAMl unmarshal validator for null valuesChanges from siderolabs/pkgs
10 commits
f694e1bfeat: update Linux to 6.18.5185a249afeat: update libpathrs to 0.2.6fe037b6feat: update Linux to 6.18.5035e3898feat: update containerd to 2.3.5fd0c2b2fix: add a kernel patch for EFI SecureBoot integrity lockdown2415a01feat: add kernel modules to enable Intel HD audio202a677feat: bump kernel to 6.18.495ddbb53feat: enable CONFIG_USB_LAN78XX and CONFIG_MICROCHIP_PHY on amd64c61bcc3feat: enable CONFIG_XFRM_INTERFACE in the kernel40ccb0dchore: sync tools & toolchainChanges from siderolabs/tools
2 commits
a404efbchore: bump util-linux 2.42.33c49a3cfeat: bump go to 1.26.8Dependency Changes
Previous release can be found at v1.14.0
Images
v1.14.0Compare Source
Welcome to the v1.15.0-alpha.1 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Boot Partition Wait
Talos now waits for the partition it was booted from to be discovered before declaring the system volumes (
META,STATE) missingand entering maintenance mode, so that disks enumerated late (SD cards, USB, some RAID controllers) are not mistaken for a fresh machine.
On UEFI systems booted via
systemd-bootthe boot partition comes from theLoaderDevicePartUUIDEFI variable, while the GRUB configurationnow passes the
talos.boot.partuuid=<UUID>kernel argument (probed by GRUB at boot). The detected boot partition is published as thebootpartitionresource.containerd Configuration Version 4
Talos now generates
containerdconfiguration withversion = 4(previouslyversion = 3).containerdonly migrates configuration from older versions, so any custom CRI configuration provided viaCRICustomizationConfigdocuments (or shipped by system extensions) is now interpreted as version 4, and settingswhich moved in version 4 are silently ignored (only a
Ignoring unknown key in TOMLwarning is logged bycontainerd).In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:
[metrics]address[plugins."io.containerd.server.v1.metrics"]address[metrics]grpc_histogram[plugins."io.containerd.metrics.v1.grpc-prometheus"]grpc_histogram[grpc]address,uid,gid,max_recv_message_size,max_send_message_size[plugins."io.containerd.server.v1.grpc"](same keys)[grpc]tcp_address,tcp_tls_ca,tcp_tls_cert,tcp_tls_key,tcp_tls_common_name[plugins."io.containerd.server.v1.grpc-tcp"]address,tls_ca,tls_cert,tls_key,tls_common_name[ttrpc]address,uid,gid[plugins."io.containerd.server.v1.ttrpc"](same keys)[debug]address,uid,gid[plugins."io.containerd.server.v1.debug"](same keys)For example, the
containerdmetrics customization documented for previous versions of Talos:should now be written as:
Note that
[debug]level,formatandlog_trace_idstay at the top level, and that thettrpcaddress is no longerderived from the
grpcaddress: if thegrpcaddress is customized, thettrpcplugin address has to be set explicitly.Unified --namespace Flag
talosctl containers,logs,statsandrestartnow select the containerd namespace through the same--namespaceflag and vocabulary already used bytalosctl imageandtalosctl debug:system(the default),crifor Kubernetes workloads, andtaloscontainersfor containers declared via aContainerConfigdocument.The
--kubernetes/-kflag is deprecated in favor of--namespace cri.talosctl image listalso supports--namespace taloscontainers, to inspect images pulled forContainerConfigcontainers.talosctl debugdoes not support thetaloscontainersnamespace.CPU Scaling Configuration
CPU frequency scaling can now be configured declaratively with the
CPUScalingConfigdocument, instead of through kernel argumentsor raw
SysfsConfigkeys:Settings apply to the cpufreq policies matched by the selector, which targets cores by property rather than by index, so a machine
whose cores are not uniform can be configured without hardcoding how many it has:
The selector matches against the fields of the
CPUScalingStatusresource, and may also setenergyPerformancePreference,minFrequencyKhzandmaxFrequencyKhz. Where several documents match the same policy, the one whose name sorts first wins, and thedocument which claimed a policy is reported on the resulting
CPUScalingSpecresource. Removing the configuration restores thevalues the machine booted with.
Setting a cpufreq attribute through both
CPUScalingConfigandSysfsConfigis rejected, as the two would otherwise overwrite eachother continuously.
Disk SMART Status
Talos can now collect SMART (Self-Monitoring, Analysis and Reporting Technology) health information from disks,
exposed via the new
SMARTStatusresource (one per disk, keyed by the disk device name).Collection is controlled by the presence of the new
DiskSMARTConfigdocument: while the document is part ofthe machine configuration SMART status is collected, and removing the document disables collection (any
SMARTStatusresources already produced are removed as well). There is noenabledfield.talosctl gen configandtalosctl cluster createemit this document by default, so SMART status collectionis enabled by default for machine configurations generated by Talos 1.15. Clusters upgraded from an earlier
version keep their existing machine configuration, which carries no
DiskSMARTConfigdocument, so SMARTstatus collection stays off there until the document is added.
Rotational disks are never spun up just to be probed: a disk in standby is detected via ATA
CHECK POWER MODEand its SMART data is left untouched until it is active again.To retrieve SMART statuses:
The resource reports an overall health verdict, temperature, power-on hours and power cycles, NVMe wear
indicators (percent used, available spare, critical warning, media errors) and, for ATA/SATA disks, the raw
SMART attribute table with per-attribute thresholds.
Disk Free
A new
talosctl diskfreecommand (aliased todf) reports storage and inode usage for mounted volumes.Extension Service Configuration
ExtensionServiceConfigis supported only for extension services whose service manifest explicitly declares a configuration dependency:Using
ExtensionServiceConfigwith a service that does not declare this dependency is unsupported and has undefined startup behavior.The service might start before its configuration is rendered, leaving config files or environment variables unavailable until a later service restart.
Extension authors must declare the dependency before documenting
ExtensionServiceConfigsupport.talosctl gen removed subcommands
The following
talosctl gensubcommands have been removed:talosctl gen catalosctl gen crttalosctl gen csrtalosctl gen keytalosctl gen keypairThese commands where historically used to generate pieces of Talos PKI, but they are no longer needed
as
talosctl gen configandtalosctl gen secretsnow generate all required PKI material automatically.Blank Virtual Machine Disks
A virtual machine disk can now be provisioned as an empty volume in a storage pool, rather than only
as a CD-ROM attached from a content library:
The pool must be declared by a
StoragePooldocument in the same machine configuration; a disknaming an undeclared pool is now a configuration error rather than a virtual machine that silently
never starts.
Four behaviours are worth knowing before you rely on this:
machine and the disk, so removing the disk from the configuration leaves the data in place, and
re-declaring the same virtual machine and disk names in the same pool reattaches it. Reclaiming
the space is a deliberate, out-of-band act.
talosctl get storagepoolvolumestatuseslistsmanaged volumes, not retained orphan files: their statuses disappear when their requests and
consumers are gone. Inspect the pool's backing directory to discover retained files before
reclaiming space; confirm a file is no longer in use before deleting it.
sizegrows the volume the next time no virtual machine has it open,because growing one underneath a running guest corrupts qcow2 metadata and is invisible to the
guest for raw. The pending growth is reported on the volume's status.
sizeis reported and ignored. Shrinking would truncate a filesystem the guest laidout, so it is refused rather than applied; the disk stays attachable and the virtual machine keeps
running.
StoragePooldocument. Removing areferenced pool alone is rejected by configuration validation. Remove or update every virtual
machine referencing it in the same configuration change. During teardown, consumers release
the pool before it is undefined and its backing directory can be unmounted. The volume files
survive.
Provisioning a disk from a content library image is not implemented yet;
provision.fromImageisstill only supported on a
cdrom.Ignore Ctrl-Alt-Delete
Setting
ignoreCtrlAltDelete: truein theSecurityProfileConfigdocument makes Talos log and ignore Ctrl-Alt-Delete instead of rebooting the machine.Ctrl-Alt-Delete still reboots the machine until a configuration with this option is applied.
IPVS Support
Following Kubernetes deprecation of IPVS support (
kube-proxy), Talos Linux now ships IPVS as kernel modules which are not loaded by default.If you require IPVS support, you can enable it by loading the following kernel modules:
ip_vs(core)ip_vs_rr,ip_vs_wrr,ip_vs_lc,ip_vs_shorip_vs_mh(scheduling algorithms)xt_ipvs(nftables/iptables match)Kernel Log Extra Tags
The
KmsgLogConfigdocument now supports anextraTagsfield which attaches additional key-value pairsto every kernel log message sent to that destination:
Tags are scoped to the destination they are configured on, so different endpoints can receive different tags.
The keys
facility,seq,clock,priority,msg,talos-timeandtalos-levelare reserved and rejected,as they are set by Talos itself.
Kubelet Image GC Thresholds
Talos now defaults kubelet
imageGCHighThresholdPercentto 75 andimageGCLowThresholdPercentto 65 (upstream defaults are 85 and 80).The upstream image GC high threshold matches the default
imagefs.available<15%hard eviction threshold, so the node was putinto
DiskPressure(and tainted forevictionPressureTransitionPeriod) before image GC had a chance to run.The defaults are applied only if neither of the thresholds is set in
machine.kubelet.extraConfig.On upgrade, nodes with disk usage above 75% will garbage collect unused images.
Kubelet Resource Manager State
Talos now validates the kubelet CPU manager and memory manager state files (
/var/lib/kubelet/cpu_manager_state,/var/lib/kubelet/memory_manager_state)the same way kubelet does on startup, and removes a state file kubelet would refuse to load before starting kubelet.
Previously only a change of the manager policy was detected, so changing e.g.
reservedSystemCPUsorreservedMemory, ora change of the CPU/NUMA topology of the machine, left kubelet unable to start until the state file was removed manually.
Only the rendered
KubeletConfiguration(machine.kubelet.extraConfig) is checked: the resource manager settings passed as kubeletcommand line flags via
machine.kubelet.extraArgs(e.g.--cpu-manager-policy,--reserved-cpus) are not taken into account.KubeSpan Peer Endpoint Filters
KubeSpan now supports filtering the endpoints received from other peers via
filters.peerEndpointsin theKubeSpanConfigdocument.While
filters.endpointsfilters the addresses a node advertises to the whole cluster,filters.peerEndpointsfilters the endpointsreceived from other peers before the node connects to them, affecting only that node. This allows excluding peer-advertised endpoints
which are known to be unreachable from a node (e.g., addresses of a private network the node is not connected to), so that KubeSpan
endpoint rotation never attempts them.
LLDP Neighbor Discovery
Talos now listens for LLDP on physical Ethernet interfaces and reports neighbors through the
LLDPNeighborStatusresource.Reported information includes chassis and port IDs, system and port descriptions, system names, management addresses, and VLANs.
The built-in listener does not transmit advertisements; use the
lldpdsystem extension when advertising is required.Secure Boot images no longer have lockdown=confidentiality enabled by default
Secure Boot images no longer have
lockdown=confidentialityenabled by default.This change was made to improve compatibility with eBPF tooling under default schematic.
This means that Secure Boot images will now have
lockdown=integrityenabled by default (implicitly), which is the recommended setting for most users.Users can override it by adding
lockdown=confidentialityto the kernel command line through Image Factory if they require it.MACVLAN Links
Talos Linux now supports creating MACVLAN links with a new
MacVLANConfigdocument:The
sourcemode is not supported yet, as it requires a list of allowed source MAC addresses.Multipath Configuration
The
multipath-toolssystem extension now reads/etc/multipath.conffrom the Talos host instead of usingExtensionServiceConfig.The
multipathdservice waits for this file and bind-mounts it read-only into its service container.Before updating the extension, apply a machine config patch that deletes the existing
ExtensionServiceConfigdocument and adds anEtcFileConfigdocument:The extension does not provide a default configuration, so
multipathdremains waiting until/etc/multipath.confis present.NFS External Volumes
Talos now supports NFS as an
ExternalVolumeConfigfilesystem type alongsidevirtiofs, allowing nodes to mount network exports at/var/mnt/<name>through the existing block volume machinery.Supported
versionvalues are3,4,4.1, and4.2.The
mount.nfsspec configures the kernel NFS client:server(hostname or IP; IPv6 is bracketed automatically) and absolutepathare required; optionalport,transport(tcp/udp), and NFSv3-onlymountPort/mountTransport(otherwiserpcbinddiscovery is used).locking(localdefault /remote) controlsnolock/lock; Talos does not runrpc.statd, solocal(nolock) is the safe default. You needrpc.statdextension for remote locking.recovery(hard/soft/soft-error) maps tohard/soft/softerr.timeout(timeo, deciseconds),retransmissions(retrans),readSize/writeSize(rsize/wsize, 1024–1048576 multiples of 1024),connections(nconnect, 1–16, TCP only),reservedPort(resvport/noresvport), andsecurity(none/sys; Kerberos flavors are unsupported as Talos does not runrpc.gssd).tcptransport.Common
mountflags (readOnly,disableAccessTime,secure) apply as with other volume types.Validation rejects
mountPort/mountTransport/lockingoutside NFSv3 andudpfor NFSv4.NUMA Topology and VM Placement Validation
Talos reports host NUMA nodes, CPU membership and total node memory through the
NUMATopologyresource.Explicit VM CPU pins and memory-node selections are checked against the host before starting or replacing a guest.
Invalid placement leaves an existing guest running; CPUs and guest memory may intentionally use different nodes.
This validates placement, not available memory capacity or reservations. Host inventory is not exposed in container mode.
Route Updates
RouteSpecresource IDs now match the key the Linux kernel uses for routes: routing table, address family, destination and priority (metric),e.g.
inet4/10.0.0.0/8/1024instead ofinet4/10.0.0.1/10.0.0.0/8/1024.The gateway, the output link and the multipath next-hops are no longer part of the ID, so changing them updates the route in place
(
RTM_NEWROUTEwithNLM_F_REPLACE) without the route ever being missing, e.g. when a BGP route switches between a single next-hop and ECMP.Routes which differ only in the next-hops (which can't be installed into the kernel at the same time) are now merged into a single route,
with the higher configuration layer taking precedence.
RouteStatusresource IDs are not changed.Permissions of the Generated Files
talosctlnow writes every file which might contain secrets with0600permissions (owner read/write only),and it restricts the permissions of the files it overwrites as well.
This affects the machine configuration (
talosctl gen config,talosctl machineconfig patch,talosctl cluster create --skip-injecting-config),talosconfigandkubeconfig.Time Check API
The
TimeService/TimeCheckAPI (talosctl time --check) is no longer available to theos:readerrole, as it allows queryingarbitrary time servers from the node. The
TimeService/TimeAPI (querying the configured time server) is still available toos:reader.PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under
/dev,the name should start with
ptp(e.g./dev/ptp0,/dev/ptp_kvm), and the device should be a PTP character device.Filesystem Trim Chunking
The
FilesystemTrimConfigdocument (and the per-volumetrimsettings) now supportchunkSize,chunkDelayandminLengthoptions.By default, the whole filesystem is trimmed at once (same as the
fstrimcommand), which issues discards for all free space back-to-backand might cause latency spikes for other workloads on the same disk (e.g. etcd).
Setting
chunkSizesplits the trim into multiple operations withchunkDelayin between, whileminLengthskips free ranges smaller than the specified size.Component Updates
Linux: 6.18.55
Kubernetes: 1.38.0-alpha.2
containerd: 2.3.6
runc: 1.5.2
CoreDNS: 1.14.7
systemd-udevd: 262
Talos is built with Go 1.27.2.
Virtual Machine Serial Console
Talos-managed virtual machines now expose their serial console over the Talos API, with no host shell access required.
talosctl hypervisor console <vm-name>attaches to the live serial console of a running VM.Press
Ctrl-]to detach without stopping the VM;Ctrl-Cis forwarded to the guest.Only one session can be attached to a VM at a time, and previous output is not replayed.
The command is supported on Unix clients only.
Serial output is also persisted on the host (with bounded retention), and can be read with
talosctl logs --kind=vm <vm-name>,including
--tailand--follow. The new--kindflag (container,vmorservice) selects the log source explicitly;omitting it keeps the previous service/container routing.
Both the console and the VM logs require the
os:adminrole and a single target node.Virtual Machine VNC Console
The new
talosctl hypervisor vnc <vm-name>command forwards a virtual machine's graphical console to a local loopback TCP port.Enable
console.vnc.enabledin itsVirtualMachineConfig; access requires theos:adminrole and exactly one target node.The listener accepts one viewer at a time and supports reconnecting without restarting the command.
Use a viewer that supports unauthenticated RFB.
Talos authenticates the tunnel, and no VNC TCP port is opened on the node.
VXLAN Links
Talos Linux now supports creating VXLAN links with a new
VXLANConfigdocument:Workload Memory Limits
The new
WorkloadResourceConfigdocument sets independent aggregate memory limits for Kubernetes pods, Talos containers and virtual machines:Each root is optional. Limits are ceilings, not reservations, and do not cover swap or HugeTLB memory.
For
kubepods, Talos derivessystemReserved.memoryso kubelet enforces the cap and adjusts Node Allocatable;an explicit
systemReserved.memory, conflicting kubelet flags or the Static memory manager cannot be combined with this limit.Changing the Kubernetes cap restarts kubelet. Without Kubernetes, only the container and virtual machine limits apply.
Lowering a limit can OOM-kill workloads in that group, including QEMU guests or Kubernetes control-plane pods.
Talos exclusively owns
memory.maxon/taloscontainersand/virtualmachines.partition, even without this document.Omitting their limits means unlimited aggregate memory; individual child limits still apply.
Kubelet system-reserved or kube-reserved memory enforcement on these roots is rejected regardless of this document;
CPU-only or compressible enforcement and reservations on unrelated roots remain supported.
Kubelet drop-in directories are rejected while any cap is active; without caps, their contents remain the operator's responsibility.
Removing the Kubernetes cap restores the original kubelet configuration. The document has no effect in container mode.
Contributors
Changes
282 commits
2682d461efeat: provision blank virtual machine disks in storage poolsb834e3cb6fix: remove the NUMANodes flag from cluster create qemu cmd53c484f96feat: configurable video device for virtual machines340df0456feat: bump kubernetes to v1.38.0-alpha.2751f65514feat: show guest VM IPs from qemu-guest-agent3e41f2501feat: bump depsb9e82ebdcfix: vm console queue overflows on read3c0838b39test: isolate concurrent IPv4 route scope fixtures0e17fa324test: bound NUMA reconciliation triggers by suite lifetimeee6a6bd8atest: synchronize VNC cancellation coverageb5f476ddafeat: reconcile CPU partition policydf0193f5efeat: add authenticated VNC access to virtual machinesb4178e11atest: distinguish concurrent foreign route fixtures44c569644chore: add VM serial console release notes4e2e4f308feat: add host NUMA topology and validate VM placementb277651cafeat: attach qemu-guest channel to virtual machines051a4bf6dtest: wait for device removal before testing disk recreation04dde9148test: make DNS bind failure independent of interface addresses4948088b0feat: add aggregate workload memory limits1227b2b84feat: provision cloud-init seed assets for virtual machines8fca67333test: talos container status coverage5ca54ad2efeat: plan safe CPU partition updateseb958e61etest: improve hypervisor unit tests stability4194ca142feat: persist VM serial logs and add explicit log kind selection527a272c5feat: content lib. locking, vm resource chainingcf07b8a7ffeat: impl. VirtualMachineConfig - gueste18d5ce09feat: add CPU partition cgroup operations6b1edb94dtest: boot stock Alpine ISO over serial console3663614bafeat: rework route configurationda3c10225fix: clean up mountpoints on unmount738f1ab8ffix: roll back stacked try configs to the config before the first trye880b96c0feat: add CPU partition configurationbdfe7bd2btest: coverage for explicit vm stop, before deleted63f6c38bfeat: add CPU partition resource typesa5aa41488test(ci): add hypervisor short pipelinee7b50c50dfeat: vm disk provisioning from iso7396302bafeat: set vm domaincpu to host-model83a80df90fix: verify the claim for the legacy bundle image verification95c86b810fix: correct handling of DHCP changing addresse1386c60dfix: image verification testb77b8b8bcfeat: add hypervisor VM serial console streaming87e039ea9fix: make GenerateClientConfiguration API work in K8s-less modebf9d68ed6feat: update Kubernetes to 1.38.0-alpha.1a003bd22bfix: restore source names for pseudo filesystem mountsb3736b9a9fix: network on azure (and might fix some other platforms)41e63cb24fix: skip impersonation tests without Kubernetesef5bdc8dcfix: gate libvirt dial on virtqemud readiness53fa44cbffix: add validation for the PTP device nameb6a32fc16fix: reject impersonation header without impersonator role76e761d83fix: validate ExtensionServiceConfig name21b74679ffeat: add support for chunked fstrim5b7c96d75feat: override the kubelet's image GC thresholds7e972eecffeat: impl. hypervisor network tap90e22ed5bfeat: update etcd to 3.7.22363acc1efix: hv domain status ctrl must use openpersistent6d70efe9ffeat: bring in Linux 6.18.54, runc 1.5.26b333c145fix: don't overwrite currently booted on upgrade for GRUB1ea1724bbfeat: add virtual machine CPU pinning and NUMA placementcb9852c4efeat: add VirtualMachineStatus resource13426fd28test: avoid racing CPU scaling sysfs writescad70acb2feat: add ignoreCtrlAltDelete to SecurityProfileConfig494abedf6docs: clarify the KMS endpoint schemefede90e81feat: talosctl dashboard container support691a26f18fix: installer-with-extension image tag handling92fdb5b08test: fix OOM kills in TinkSuitebfa1ef264fix: drop devices from the last observed generation if they are gone8c90991bdfeat: add LVFS metadata parsing and PKCS7 verification3f3a1e01afix: type VM CPU limits for 32-bit talosctl builds6a1ff6688feat: place virtual machines in a Talos-owned cgroup partition6ced93742feat: handle the change in kubelet's CPU and memory policies0438aa72dchore: mark generated code and reference docs as generatedd5393f3effeat: reconcile virtual machine domains with libvirtb230c581afeat: update containerd to 2.3.60e7245da4fix: reject extra config merge pathsf3aa7374cfeat: add CPU frequency scaling controllercd48649d2chore: fix build of talosctl on non-Linuxab6af70d1test: fix the md-boot pipeline59ff84267feat: detect and publish hybrid ISO partitions0e3511020test: add a test exercising partitions on top of DM devices6304eeb40fix: relax the validation for block device wipe0553b3e51feat: support partitions on device mapper devices0962b72d6fix: disable storagepool controllers in container mode5592dc59afeat: impl. virtualmachineconfig - networking3c9c65f0fchore: validate VM domain XML against libvirt schemaa61097889feat: add libvirt storage pool configuration515a590eafix: pass boot partition UUID on kexecb6ec9e7d8feat: translate virtual machine configuration into domain specsa40182833refactor: hypervisor test pipelinefa69d23b5chore: drop some talosctl gen subcommands6fe8bafa5fix: perform stricter validation of hostnames/search domainsef123b413feat: update Linux to 6.18.532976d533frefactor: add enums for vm conf str-fields53ec6047etest: bump Go version for cloud imagesb56f98033test: fix cilium triggered testf11bd1c0afix: handle correctly routes without outlinkname setab3d78b44feat: impl. virtualmachineconfig powerstateed7111fbbfeat: provide SecureBoot fingerprints used during boot5248bba87docs: update bug issue templateee0a723befix: do not disclose pre-shared Wireguard key in LinkStatus56f9c6a08chore: clean up unused settings in LVM reconcile controllersa314372a1feat: impl. virtualmachineconfig - firmware5f0b06335feat: impl. virtualmachineconfig - console34c306f32fix: report selected context in talosctl config info36bed8610fix: retry transient LVM reconciliation failures93c711852feat: impl. virtualmachineconfig - disksf188ff448feat: content library upload verification4ecd21a54docs: add a note about the dev command to the qemu commanddf493c685fix: ignore missing device nodes for inotifya4b38516bchore: automatic linting fixesdfabc0ed7chore: update dependencies8cf987052chore: bump CSI helm chartsd2de8e21cfix: preserve hostname under Docker (in container mode)f04a3438efeat: add macsec module4d024ecf8feat: add virtualmachineconfig571c4665drefactor: move size types to config/types/metacc815177dfix: apply config patches last in talosctl cluster create9d5901f7dfeat: content library api, talosctl support657a95a68chore: implement controller/resource tracera26d35862docs: clarify admission control and flannel config docs5d1981ecafeat: add contentlibrary resources, ctrlb46b3b872feat: implement boot device wait in volume manager35d67a3a5test: fix the aws-arm64 test956c739c9refactor: container dependency status spec05f60de61feat: report LLDP neighbors on physical links2d2567ba8fix: use correct conditions on CRI <> sandboxd dependencyacdcc9cdafeat: update Linux to 6.18.526e59bd86cfeat: update SideroLink library to v0.3.182f5cc2fb0fix: extend the USB settle code for more code paths0e1fdd26afeat: impl container status controller64c3de56bchore: pass kernel version down to VEX generator8fe31217dchore: update dockerfile syntaxfe4bd64c9chore: update integration k8s helm charts0129eac91chore: update helm, cilium cli817a479c6chore: update tools and pkgsd66c60a98fix: prevent sandboxd signal dispositions leaking into services64f8f83c1test: peer passively with the MetalLB speaker75eea7897test: stop ARP flux breaking the BGP VRF testbebcad562fix: rebuild the BGP server when its VRF is recreated175925220fix: create GRUB bootloader ISOs only for BIOS78a70ed5etest: check owned mounts in hostns cleanup testsba50b647ftest: skip the macvlan DHCP test on full-CLOS clusters7f5327d5bfix: guard against nil config document slices2e23abc13fix: reconnect the WireGuard over gRPC tunnel after a failurea1d2ce2a7feat: support disk smart config and statuscc92d40a7fix: tighten the validation of v1alpha1 configs vs. migration66c7d4505docs: clarify the kube-apiserver extra args and new config5d2fa54eetest: test Cilium with SELinux enforcing mode8a615bf5adocs: correct the UnattendedInstallConfig name in the schema4327e1083fix: make --insecure reachable for talosctl meta subcommandsf715d06a4fix: ignore apply config dry-run for try mode850a4384btest: add a way to provision extra DHCP entries in the test8537cf06bfix: drop logical links if they no longer declare as logicalb8aa858d9fix: resolve volume devices in shared selector helper64355d0e3fix: create LVM physical volumes on the decrypted device189086bd6fix: bump history max cap to 1536ee71f190efeat: upate Linux to 6.18.50b735fd683feat: add NixOS OVMF search pathf593732fafix: support ARMv7 talosctl builds682a0c96dfix: gate NFS server behind linux build tag5c5fd29e9fix: restrict generated configuration file permissions85aa3ea93feat: discover bmc over local ipmi interface7ee755a87feat: add NFS external volume support12dfb8e1arelease(v1.15.0-alpha.0): prepare releasef3017d31efix: add missing extension test patches for nfs67ae852a9fix: wait for USB settle explicitly274dc8581fix(security): define the permissions the 6.18 kernel expects in the classes28841f4c4fix: empty searchdomains dropped on merge5a67d1e8echore: support correctly various disk types for the system disk834ba888afix: improve resilience of the action tracker against dropped connsa2d35a90cfix: notify about link alias changes9de219cfbtest: nvidia - switch to nri24ef6f436fix: use the final config version in upgrade-k8sa1ec9d567docs: update CODE_OF_CONDUCT.md6a8b836f2fix: set TCP keealive and user timeout on apid proxied connections607ee15c9chore: use the host page cache for the QEMU cluster disksa6bde65fdfeat: allow generating an ECDSA service account key in secrets bundlesecb012883feat: update containerd to 2.3.554204560cfeat: bump to containerd config version 4a42ea1d4afeat: add KubeSpan peer endpoint filters0bd0cc8fcfix: ensure lockdown integrity in SecureBoot mode7eb4e75c1feat: add KmsgLogConfig extraTags support01ebf95a0feat: add VXLAN interface configuration support019b5f432feat: add macvlan interface configuration supportf5dc088fdfix: correct the bug with overlay assets in ESP being dropped465a691f7feat: update Linux to 6.18.490666eed65fix: harden the code around kubelet's client certificate handling5a2dfd460test: revert disabling PS/2 in QEMU6b16225b6fix: correct typos in talosctl output, comments and config example5da7387c9docs: fix containerconfig.dependson examples9f2eb6fb4test: relax OOM test conditions9361ad0c1fix: normalize image reference when passing to image verification flow7fd43a419fix: name diskSelector in UnattendedInstallConfig validation errors7aeb7d4a8test: isolate base OCI spec test in BGP CLOS runs27ea73811feat: add USB LAN78XX drivers to the rootfsd7d41b53dfix: filter out passed metadata in API proxyingba625bc5efix: allow CSI volumes to be mounted with an SELinux contextfc0a1f020test: libvirtd extensions6e1c0cd42fix: filter the output in talosctlb1b173f59fix: treat desired roles empty as error in Talos API accessed3a1e091fix: handle Akamai/Linode metadata without IPv69c058f898feat: talos containers run with imagegccontroller9cba2783ffix: container mount rshared propagation241d55f37refactor: don't skip container tests in short mode10e8fb449fix: ctr machinedaccss allowed roles86628c57efix: validate received kubeconfig083e7f923fix: drop dead legacy registries init from worker generationa8c09fb73fix: exclude scheduler config from apiserver config versionb46c53e8ffix: keep the time sync boot timeout across a syncer restarta4707d403test: skip filemap heap test under race detector86bfa8c21feat: bump kernel to 6.18.486ee461278fix: escape output in the talosctl dashboard1ee84b268fix: use os.Root in the talosctl extract pathd970ebca4chore: speed up unit-testsd5f53edeefix: add checks for meta key in the API path6b1d1845cfeat: update COSI to 1.16.3bfb8dfcc4feat: add host extension pre-shutdown hookse434671d7fix: preserve shared libs symlinksfd0eee43ffix: drop libssl from the rootfsf7065d3c2fix: route creation churning every 100ms6f7b08ab4chore: reduce verbosity of the grype scan4f7f5c2fafix: drop gRPC client keepalive aggressive settings in the tracker1b1905a07chore: bump sigstore/rekor to v1.5.4ea5484ba2chore: add SPD5118 driver to squashfs770e5cdd6fix: preserve special modes when extracting files613463d64feat: containers can connect to machinedabff95d73feat: bump kubernetes to 1.37.0ba2d9a773refactor: log filter stays enabled on enter press0179b80f5fix: hostns etc mount6dcde1d9efeat: impl. container mount controller48fe469a8fix: write the uploaded etcd snapshot atomicallyf25b4a3ccchore: update multipath notes86d76b0dffeat: support host extension servicesd70eb0078feat: talos containers support for talosctl4f56e5f44fix: cache filemap layers on disk1bb6e1f10fix: skip selinux label for read-only/detached/external mounts7ca297a11feat: add xfrm interface modulee489f9538fix: capture packets correctly on VLANse12769b1ftest: update Image Factory Talos versions17b631eb0feat: update Linux to 6.18.4600ec33789fix: enable additional SELinux permissions for Cilium9c747cb2efix: use os.Root in the untar pathf48e688bfdocs: update CRI customization example15c3d1a4btest: apid tls provider8979ecefefeat: impl. container runtime controller0ae93592brefactor: make runner.runner context-native48e604d52fix(talosctl): preserve uncompressed cached image layers1205defbbfix: use default terminal theme colors in talosctl dashboarde8872ff71fix: don't create new client in dry-run modef61de6f44fix: preserve selected sd-boot entry on upgradead8823176feat: add a talosctl df command78e378a48fix: use the UKI command line when the config has no install sectiona469e965afix: persist in-memory meta on fresh installa72281e5bfix: drop lockdown=confidentiality default for 1.14+f80fd0985fix: reduce stalls in the etcd member promotion cycle3b3e0e955feat: update Go to 1.26.741c0c0a02feat: update CoreDNS to 1.14.7481f98d8cfeat: update Kubernetes to 1.37.0-rc.1dcfb17c96feat: implement support for primary setting for the BondConfig63bd62c9cfix: watch IPv6 route changes in RouteSpecControllerb2693f08efeat: update Linux to 6.18.45398d2be8dfix: enable SELinux to work with overlaysdf72d021ffix: move the spike information field of the time.Status resource8b5f1097bchore: ensure nightlies only run in one regionf7305d6f5feat: impl ContainerInstanceControllerfdf0efa8bfeat: log peer address in gRPC request log013b9489efeat: talosctl dashboard log filtering5fcf360fefix: truncate files replaced by system extensions4c575c207fix: skip target settings for external volume mountsc685f2712chore: update disvulncheck datesaaf35fbdefix: use v1.13 config to test downgrade failure2b0316913test: use tiny hostns debug image42d72ed56feat: move IPVS support into modulesbe6b96386fix: support try mode apply without prior config68876cc1efix: adjust cluster size for VFAT on ISO9cb5dc9b9feat: update containerd to 2.3.432f7fc0dffeat: impl ContainerImageController5675ada21test: add cachefilesd to the test matrixa1183478afix: apply directory user volume mount security55e0f6350fix: install conntrack handler in accept ingress firewall mode1c50b73fbfix: share IPC namespace with the host for extension services6cda3e2e2chore: prepare for Talos 1.158514d9963fix: provide read-only random seed in the ISOChanges from siderolabs/gen
2 commits
cbd9518chore: rekres and update deps26ccee1feat: provide new YAMl unmarshal validator for null valuesChanges from siderolabs/go-debug
1 commit
44d6398feat: support Go 1.27Changes from siderolabs/go-kubernetes
2 commits
1a7f4fbfix: set a logger on the ssa controller-runtime clientf752bb3feat: add Kubernetes 1.38 compatibilityChanges from siderolabs/go-lldp
4 commits
09c4339feat: add a Linux LLDP receiver76e7deffix: stop LLDP decoding at the end markera5ba2a7chore: kresify and lint fixesafd9f83lldp: initial commitChanges from siderolabs/go-pcidb
1 commit
78c9051feat: update PCI IDs to the latest availableChanges from siderolabs/pkgs
53 commits
305b1b6feat: bump deps2a7769efeat: enable bhyve guest support on amd64ce4bafbfeat: enable CONFIG_DRM_ACCEL_AMDXDNA on amd648f7ce6cfeat: enable CONFIG_MOTORCOMM_PHY on arm64fa71c34feat: enable pNFS block and SCSI layouts in nfsdf6b8411feat: add hailort v5 package64af669feat: enable Qualcomm Cloud AI 100 (QAIC) driver518972afix: add a patch to fix booting on Apple hardware2b782b6feat: update Linux to 6.18.54, runc to 1.5.24871c10feat: enable CONFIG_CRYPTO_ECC, CONFIG_CRYPTO_ECDH on arm64 to match amd64b4cb94cfeat: enable CONFIG_BLK_WBT6868054feat: update containerd to 2.3.655806c6feat: update systemd to v262a2b57eefix: add missing sboms for swtpm12b29b3feat: update Linux to 6.18.536868000feat: bump dependenciesbed8e18feat: add swtpm777c95ffeat: enable CONFIG_MACSEC in the kernel99ec357feat: update DRBD & Linux firmwarea51429bfeat(kernel): enable CONFIG_NO_HZ_FULLb39d2c3feat: update Linux to 6.18.5269ed550feat: update Linux to 6.18.51f380535chore: rekres05913b5chore: updates 2026-09-101a28bfbchore: update tools, toolchain, rustce7b09e2feat: enable earth-pt3 dvb driver5096469feat: update libpathrs to 0.2.643e533cfeat: update Linux to 6.18.50977b61ffeat: update containerd to 2.3.543e6298fix: add a kernel patch for EFI SecureBoot integrity lockdowna8b682bfeat: add kernel modules to enable Intel HD audioff111fffeat: enable Apple Silicon platform driverse68eeb5feat: enable VIRTIO_INPUT as built-in for amd64/arm64381fc2dfeat: bump kernel to 6.18.495394321feat: enable CONFIG_USB_LAN78XX and CONFIG_MICROCHIP_PHY on amd644b9bf36fix: preserve symlinks for libudev50bf09ffix: update OpenSSL to 3.6.4f2b7acffeat: update kernel to 6.18.4873327fffeat: bump kernel to 6.18.47b6b2843feat: enable CONFIG_XFRM_INTERFACE in the kernel696fa3cfeat: expose more software as pkgsaa069d3chore: update OpenZFS to 2.4.4c1837b6feat: bump kernel to 6.18.4628f5f23feat: enable SPD5118 sensor driverbc45b69feat: backport aes256k support (Ceph)b914c26feat: update Go to 1.26.7caac515feat: update Linux to 6.18.45ada230afeat: enable IPSec offload and dma-buf heaps33d14e0feat(kernel): enable CONFIG_MLX5_VFIO_PCI107b628feat: kernel: enable MPTCP, sched_extc9173bbfeat: move IPVS into modulesd418aa7feat: update containerd to 2.3.4c4a6a61feat: update Go to 1.26.6Changes from siderolabs/siderolink
6 commits
755a982chore: update dependencies and rekres5d6e09ffix: rework keying of the streams to the peersad296abchore: rekres, bump deps23030b0fix: keep a replacement gRPC stream's send queue after cleanup4b69f46fix: correct the wireguard device error handling5157d0cfix: accept valid short IPv6 packets on filtered devicesChanges from siderolabs/tools
13 commits
32e115cfix: restore llvm 22 for rust compatibility47166adfeat: bump depsd40b203feat: update tools components19bb4b7chore: downgrade llvm to major 22b28aa66chore: bump util-linux 2.42.31023701chore: update dependencies 2026-09-08c3165c7chore: update toolchain image09ccc74feat: bump go to 1.26.835fab51fix: update OpenSSL to 3.6.4e033f2afeat: move more packages into separate imagesd102f15feat: update Go to 1.26.7fd531a3feat: update Go to 1.26.65eabe31chore: rekres 2026-08-12Dependency Changes
486c28bnew1a83157newffadbf3newc308df0->234b974529eae5newfdeea32->3075585cf1189dnewPrevious release can be found at v1.14.0
v1.13.11Compare Source
Talos 1.13.11 (2026-10-01)
Welcome to the v1.13.11 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Time Check API
The
TimeService/TimeCheckAPI (talosctl time --check) is no longer available to theos:readerrole, as it allows queryingarbitrary time servers from the node. The
TimeService/TimeAPI (querying the configured time server) is still available toos:reader.PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under
/dev,the name should start with
ptp(e.g./dev/ptp0,/dev/ptp_kvm), and the device should be a PTP character device.Component Updates
Linux: 6.18.54
containerd: 2.2.9
Talos is built with Go 1.26.7
Contributors
Changes
13 commits
638bd94release(v1.13.11): prepare release5f3e4fctest: fix up tests for default OCI spec4fe094efix: add validation for the PTP device name56c81cffix: drop devices from the last observed generation if they are gonebd7a2d4fix: perform stricter validation of hostnames/search domainsdbe8e02fix: do not disclose pre-shared Wireguard key in LinkStatus00db0afchore: pass kernel version down to VEX generator5008991fix: reconnect the WireGuard over gRPC tunnel after a failure0077a50fix: drop logical links if they no longer declare as logical29b1e65fix: notify about link alias changes118a773fix(security): define the permissions the 6.18 kernel expects in the classes365e3c4fix: set TCP keealive and user timeout on apid proxied connections080979bfeat: update pkgs/toolsChanges from siderolabs/pkgs
10 commits
642a01bfeat: update containerd to 2.2.93016b61fix: add a patch to fix booting on Apple hardware889ec2bfeat: update Linux to 6.18.54b554743feat: update Linux to 6.18.53574809bfeat: update DRBD & Linux firmware6f29f5dfeat: update Linux to 6.18.521737c02feat: update Linux to 6.18.516b76586feat: update Linux to 6.18.50bb9fe70feat: bump kernel to 6.18.496187366chore: sync toolsChanges from siderolabs/tools
2 commits
b912600feat: update pcre to 10.487b95365chore: bump util-linux 2.42.3Dependency Changes
Previous release can be found at v1.13.10
Images
v1.13.10Compare Source
Talos 1.13.10 (2026-09-03)
Welcome to the v1.13.10 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.48
CoreDNS: 1.14.7
Talos is built with Go 1.26.7
Contributors
Changes
28 commits
00ca4c9release(v1.13.10): prepare release271ce0dfix: update DHCP library3c70f40fix: harden the code around kubelet's client certificate handling40d7de4fix: normalize image reference when passing to image verification flowcf30d6dfix: filter out passed metadata in API proxyingcc556d9fix: treat desired roles empty as error in Talos API access0d7a473fix: allow CSI volumes to be mounted with an SELinux context17ab196fix: validate received kubeconfig934ae8achore: update etcd to v3.6.14df9b82dchore: update pkgs and tools591c53afix: use os.Root in the talosctl extract pathc36d990fix: escape output in the talosctl dashboardfc355dcfix: add checks for meta key in the API pathe950f65feat: update COSI to 1.16.320cafbdfix: route creation churning every 100msc6fe78cchore: reduce verbosity of the grype scanb9696f9fix: preserve special modes when extracting files865aaecfix: use os.Root in the untar path097fa18fix: create parent directories when extracting tar archivesc6edc39chore: bump sigstore/rekor to v1.5.46d062e1fix: write the uploaded etcd snapshot atomicallyf6b7959fix: skip selinux label for read-only/detached/external mountsbea850afix: persist in-memory meta on fresh installdcf46c1fix: reduce stalls in the etcd member promotion cycle0f4d08afeat: update CoreDNS to 1.14.7e091638fix: watch IPv6 route changes in RouteSpecController92614cafix: truncate files replaced by system extensionsb7b27ecfix: skip target settings for external volume mountsChanges from siderolabs/pkgs
5 commits
9b044c5feat: update kernel to 6.18.48de74a50feat: bump kernel to 6.18.47bb15c62chore: update toolchain and tools49c50f7feat: bump kernel to 6.18.462da2cdcfeat: backport aes256k support (Ceph)Changes from siderolabs/tools
3 commits
c70be08chore: update toolchain7791f48feat: use kernel gnu mirrorsd908dc0fix: update OpenSSL to 3.6.4Dependency Changes
5adc3eb->234b974f2248ac-> v1.36.12Previous release can be found at v1.13.9
Images
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Renovate Bot. The local configuration can be found in the SI Renovate Bot repository.
0d9ada04e4fe8338c852fe8338c852to9457318843chore(deps): update dependency siderolabs/talos to v1.14.0to chore(deps): update dependency siderolabs/talos to v1.14.19457318843tofeb49af4abchore(deps): update dependency siderolabs/talos to v1.14.1to chore(deps): update dependency siderolabs/talos to v1.14.2feb49af4abtofb6a317620chore(deps): update dependency siderolabs/talos to v1.14.2to chore(deps): update dependency siderolabs/talos to v1.14.3fb6a317620to118742ea77chore(deps): update dependency siderolabs/talos to v1.14.3to chore(deps): update dependency siderolabs/talos to v1.14.4View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.