Update ghcr.io/siderolabs/talos Docker tag to v1.13.2#29
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
f9edc65 to
d53df99
Compare
d53df99 to
1f2a601
Compare
1f2a601 to
a8b37f7
Compare
a8b37f7 to
1b07c2e
Compare
1b07c2e to
91adcd9
Compare
91adcd9 to
ed27ed3
Compare
ed27ed3 to
26a1c29
Compare
26a1c29 to
209948e
Compare
209948e to
8bf04e3
Compare
8bf04e3 to
d582803
Compare
d582803 to
09916d6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.11.5→v1.13.2Release Notes
siderolabs/talos (ghcr.io/siderolabs/talos)
v1.13.2Compare Source
v1.13.1Compare Source
v1.13.0Compare Source
44 commits
009f0d6cachore: update pkgsba56b0295feat: include hid-multitouch.ko kernel module in rootfsae29a0dccfeat: update Linux to 6.18.137cf1de279fix: bring in new version of go-cmd and go-blockdevicec8800b41efix: update path handling on talosctl cgroups0a7b6eb2cchore: test extensions8b1c974a2refactor: drop termui-widgets library5baa0028efix: add owning inventory annotation to talos manifestsd3e793d14fix: stop Kubernetes client from dynamically reloading the certs6a5a0e3bdfeat: support pattern link aliases9758bd4fefeat: update Go to 1.26e00aed0f6feat: update Kubernetes v1.36.0-alpha.1f20445ad0chore: improve logging of disk encryption handlingf018fbe7bfix: handle raw encryption keys with\nproperlye5b0eb017fix: hold user volumes root mountpoint8a0e79774refactor: split locate and provisiona59db0e92fix: improve OpenStack bare metal network configuration reliability659009ad8fix: remove stale endpointsdab0d4783fix: allow static hosts in/etc/hostswithout hostname45f214154feat: update go-kubernetes to use new Myers diff35ad0448cfix: switch to better Myers algorithm implementation0048464befeat: update etcd to v3.6.85df10f260fix: use mcopy instead of diskfs to populate VFATce53ffa90fix: disks flag parsing and handling in create qemu command3bd3dd7cafix: memory overuse in imager VFATf118ee47efix: read multi-doc machine config with newer talosctl70c6c2154feat: add filter for KubeSpan advertised networksdaf18abf4fix: fix talosctl debug in enforcing mode33b5b2565fix: ignore volumes in wave calculation without provisioninga16392559feat: add explicit service account support to Talos client4d531884echore: update dependencies406b8c83cfeat: update doc links to docs.siderolabs.com87615f551feat: implement network policies with Flannel CNI6995bc1b1chore: update homebrew formula on release7942d5a98fix: image gc controller config52e8727d0feat: add IPv6 GRE support9690dbad0chore: bump tools (including linter)2628eb2ecfix: typo with rpi_5 profile named5ebcd7cafix: stop building talosctl debug on Windows8b85c7c63chore: update depsd905035b5fix: swap volume configuration for min/max sized43a01ccbfeat: implementtalosctl debug34a31c979feat: add mount options support for existing volumes1bf95eed1feat: improve dashboard uptime displayv1.12.7Compare Source
Talos 1.12.7 (2026-04-24)
Welcome to the v1.12.7 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.24
containerd: 2.1.7
etcd: 3.6.9
Kubernetes: v1.35.4
Talos is built with Go 1.25.9.
Contributors
Changes
19 commits
91c6399release(v1.12.7): prepare release3b228cafeat: bring in apparmor profile files1a05b4afeat: update kubernetes to v1.35.4b796be0feat: bump pkgs, spdystreama75ce6ffeat: bump pkgs, toolsc1ea8dbtest: fix OOM test flaked5b691bfix: watch kubelet's kubeconfig and time out for cache sync27655c5fix: propagate route table down to the resourcefcda84bfix: boot entry detection330561cfix: do not flip machine stage to rebooting during shutdown8ef4488fix: zfs extensions test8bc593dfix: wrong slot of encryption key was logged89f5615fix: panic in reading PCR values317deedfeat: add dis-vulncheck tool0654a7ffix: handle ISOs with zeroes in volume labelse16007bfix: unseal with "slow" TPM388a56bfix: incorrect route source for on-link routes7e42474test: fix the flakes in tests with trusted rootsd52ebe2feat: update etcd to 3.6.9Changes from siderolabs/pkgs
8 commits
86d6af1fix: install apparmor parser require config filesd6b125ffeat: bump systemd191632cfeat: bump kernel to 6.18.2413cbc68feat: bump tools, toolchain and containerd709678dfeat: update Linux to 6.18.2334de6dbfix: support disabling module signature verificatione30789afeat: update backportable dependencies830d895feat: update Linux to 6.18.21Changes from siderolabs/tools
3 commits
bbd753dfeat: bump toolchain61955e9feat: bump OpenSSL to 3.6.223de89ffeat: update util-linux to 2.41.4Dependency Changes
Previous release can be found at v1.12.6
Images
v1.12.6Compare Source
Talos 1.12.6 (2026-03-19)
Welcome to the v1.12.6 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.18
runc: 1.3.5
Talos is built with Go 1.25.8.
Contributors
Changes
21 commits
a1b8bd6release(v1.12.6): prepare release72bd570feat: update Linux to 6.18.189d5638ffix: accept image cache volume encryption config0f018bffix: panic in hardware.SystemInfoControllerc46b898fix: validate missing apiVersion in config document decoderc47cad9fix: pull in a fix for dmesg timestamps190336afix: prevent stale discovered volumes reads217e9bbfix: bring in new version of go-cmd and go-blockdeviced7779a5fix: stop pulling wrong platform for imageseb6eb66fix(machined): support USERDATA legacy fallback in OpenNebula driverba20c7cfeat(machined): add ONEGATE proxy route and deterministic interface iteration for OpenNebula739f664feat(machined): inherit IP6_METHOD from METHOD in OpenNebula driver93878c0fix(machined): align OpenNebula hostname precedence with reference9718d73feat(machined): add IPv6 alias address support for OpenNebula (ETH_ALIAS_IP6)b649fb4feat(machined): support ETH*_IP6_METHOD (static/dhcp/auto/disable) for OpenNebulac81df6frefactor(machined): extract per-interface IPv4 helper in OpenNebula driver501924efix(machined): use ParseFQDN for hostname parsing in OpenNebulae9331b2feat(machined): support per-interface route metric for OpenNebula (ETH*_METRIC)6e78afbfeat(machined): add network alias support for OpenNebula (ETH_ALIAS)9f648b4feat(machined): merge global and per-interface DNS for OpenNebula04fba03feat(machined): add static routes support via ETH*_ROUTES for OpenNebulaChanges from siderolabs/go-cmd
2 commits
5f31ba9chore: rekres and updatefff5698feat: allow capturing full output to stdout, modernize APIChanges from siderolabs/go-kmsg
3 commits
b53b36dchore: rekres and update6f7d20bfeat: calculate boot time correctly if the time jumps47655eefeat: support PRINTK_CALLER kmsg logsChanges from siderolabs/pkgs
4 commits
a92bed5feat: enable AMD GPU peer-to-peer DMA09e87a9feat: backportable deps updateeb965e2feat(kernel): enable CONFIG_USB_UHCI_HCD on amd646804ebdfeat: update Linux 6.18.16, NVIDIA, ZFSDependency Changes
Previous release can be found at v1.12.5
Images
v1.12.5Compare Source
Talos 1.12.5 (2026-03-09)
Welcome to the v1.12.5 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.15
Kubernetes: 1.35.2
etcd: 3.6.8
Talos is built with Go 1.25.8.
Contributors
Changes
19 commits
da6c6e4release(v1.12.5): prepare release4f978a7fix: correctly calculate end ranges for nftables sets8d52e2dfeat: add trusted roots generation to stdpatches6284877fix: use correct dhcp option for unicast dhcp renewaldcf23befix: ignore image digest when doing upgrade-k8sf8a2a9bfix(machined): opennebula: process ETH*_ vars regardless of NETWORK context flagdb9ff23fix: patch with delete for LinkConfigse0c38e2fix: update path handling on talosctl cgroupsca2d4c1fix: stop Kubernetes client from dynamically reloading the certs70ae2f2refactor: split locate and provisionc3b0484fix: hold user volumes root mountpointd935420fix: handle raw encryption keys with\nproperly7fe1a47fix: remove stale endpoints3ea0888fix: allow static hosts in/etc/hostswithout hostname5ebb00ffix: switch to better Myers algorithm implementation2b40379feat: update etcd to v3.6.81ce9328fix: disks flag parsing and handling in create qemu command1f989dffix: read multi-doc machine config with newer talosctl40ba6e3feat: update Linux 6.18.15, Go 1.25.8Changes from siderolabs/go-debug
1 commit
47fce68feat: support Go 1.26, rekresChanges from siderolabs/pkgs
7 commits
e695c74feat: update Linux to 6.18.157d4ef68feat: update Linux to 6.18.14300cd60feat: update Linux firmware to202602265f9fd3feat: update Linux to 6.18.1396fc8e3feat: enable MLX5 Scalable Functions and TC offload in kernelf31edf1feat: add patch for Cilium BPF verifier rejection by the kernel8b4b129feat: update Go to 1.25.8Changes from siderolabs/tools
1 commit
57916cbfeat: update Go to 1.25.8Dependency Changes
Previous release can be found at v1.12.4
Images
v1.12.4Compare Source
Talos 1.12.4 (2026-02-13)
Welcome to the v1.12.4 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
KubeSpan Advertised Network Filters
KubeSpan now supports filtering of advertised networks using the
excludeAdvertisedNetworksfield in theKubeSpanConfigdocument.This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any
pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers,
and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.
Component Updates
Linux: 6.18.9
Talos is built with Go 1.25.7.
Contributors
Changes
9 commits
fc8e600release(v1.12.4): prepare release14dde14feat: add filter for KubeSpan advertised networksc277d01fix: ignore volumes in wave calculation without provisioningf90af88fix: use node podCIDRs for kubespan advertiseKubernetesNetworksa025ea4feat: add IPv6 GRE support9241254fix: typo with rpi_5 profile name64f4985fix: swap volume configuration for min/max size19354abfeat: update Linux to 6.18.9639c1c9fix: mismerge of nft with json supportChanges from siderolabs/discovery-api
2 commits
9c06846feat: change the way excluded addresses are specifiedf71a14afeat: add advertised filters to discovery dataChanges from siderolabs/pkgs
4 commits
b1fc4c6feat: update NVIDIA LTS to 580.126.16f7a8163feat: update Linux to 6.18.932290fffeat: enable ip6_greda46073feat: enable NFT_BRIDGE configDependency Changes
Previous release can be found at v1.12.3
Images
v1.12.3Compare Source
Talos 1.12.3 (2026-02-07)
Welcome to the v1.12.3 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.8
Talos is built with Go 1.25.7.
Contributors
Changes
14 commits
6d6471frelease(v1.12.3): prepare release6578200feat: update Linux kernel with dm-integrityb8f8245fix: add hostname to endpoints624f9b5chore: update deps3aa1539fix: implement merger for PercentageSizef17d07cfeat: add a helper module to generate standard patches4a3385dfix: undo CRLF on Windows (talosctl edit)a842775feat: add RPi5 to the list of supported SBCsb8cdb61fix(talosctl): pass --k8s-endpoint flag to rotate-ca kubernetes rotation27cbe29fix: skip empty documents on config decoding8f49dd2fix: open the filesystem as read-onlyb2a83d1fix: always set advertised peer URLs249acdbfix: fallback to /proc/meminfo for memory modulesbc56bdffix: add warnings to 802.3ad bondChanges from siderolabs/pkgs
3 commits
15d5d78chore: update deps4469bd7chore: update kernel51108e5feat: enable dm-integrityChanges from siderolabs/tools
2 commits
dc37e09chore: update deps36fb49afeat: update OpenSSL to 3.6.1Dependency Changes
Previous release can be found at v1.12.2
Images
v1.12.2Compare Source
Talos 1.12.2 (2026-01-22)
Welcome to the v1.12.2 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
talosctl images talos-bundlecan ignore reaching to the registryThe
talosctl images talos-bundlecommand now accepts optional--ovelaysand--extensionsflags.If those are set to
false, the command will not attempt to reach out to the container registry to fetch the latest versions and digests of the overlays and extensions.Component Updates
Linux: 6.18.5
Talos is built with Go 1.25.6.
Contributors
Changes
21 commits
54e5b43release(v1.12.2): prepare release30da0bcfix: oracle platform file format7ddb37bfix: make OOM expression a bit less sensitivee438ec2fix: marshal of FailOverMac property717ed72fix: check if the device is not mounted when wipingc95c9fdfix: wipe the first/last 1MiB in addition to wiping by signatures52bed35fix: add talos version to Hetzner Cloud client user agent0e447a4fix: make OOM controller more precise by considering separate cgroup PSI3b974b9fix: sort mirrors and tls configs when generating the machine config8b16fe5feat: add VLAN support to OpenStack platformeb8480cfix: panic in configpatcher when the whole section is missing4d44306fix: wipe disk by signaturescca4cd2feat: add it87 hwmon moduled9480eefix: resolve SideroLink Wireguard endpoint on reconnecte16c2d5fix: handle correctly incomplete RegistryTLSConfigdedd273fix: bond config via platformf527cfffix: allow HostnameConfig to be used with incomplete machine config1091813fix: lock down etcd listen address to IPv4 localhost9f8d938fix: print talosctl images to release notes95433c1fix: update VIP config example919394ffeat: update Go to 1.25.6Changes from siderolabs/pkgs
7 commits
4f8efaffix: enable pinctrl for Raspberry Pi 53a36a01feat: update NVIDIA LTS and production driver versionsd364d04feat: update Linux to 6.18.5a3d6cc4feat: update Linux firmware to202601140fa324feat: enable IT87 hwmon module8b8f314feat: enable IPV6_MROUTE3571127feat: update Go to 1.25.6Changes from siderolabs/tools
1 commit
31959f4feat: update Go to 1.25.6Dependency Changes
Previous release can be found at v1.12.1
Images
v1.12.1Compare Source
Talos 1.12.1 (2026-01-05)
Welcome to the v1.12.1 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.2
Talos is built with Go 1.25.5.
Contributors
Changes
7 commits
7ea2ef7release(v1.12.1): prepare release78a7856chore: run rekres and update dependenciesc310671fix: disable swap for system servicesa7e8426test: skip the source bundle on exact tag9439841fix: probe small images correctly42df716fix: invalid versions check in talos-bundlea3e90e4fix: make upgrade work with SELinux enforcing=1Changes from siderolabs/pkgs
2 commits
90ff196chore: run rekres and update dependencies2b30517feat: update Linux to 6.18.2Changes from siderolabs/tools
1 commit
5df8baechore: run rekres and update dependenciesDependency Changes
Previous release can be found at v1.12.0
Images
v1.12.0Compare Source
Welcome to the v1.13.0-alpha.2 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Clang built kernel and ThinLTO
Talos now uses a kernel built using Clang compiler, and optimized using ThinLTO. This should bring a small performance improvement,
alongside some hardening features, such as BTI on supported ARM systems.
talosctl debug
Talos Linux now provides a way to run and attach to the privileged debug container with a user-provided container image.
The debug container might be used for troubleshooting and debugging purposes.
Environment Configuration Document
A new
EnvironmentConfigdocument has been introduced to allow users to specify environment variables for Talos components.It replaces and deprecates the previous method of setting environment variables via the
.machine.envfield.Multiple values for the same environment variable will replace previous values, with the last one taking precedence.
To remove an environment variable, remove it from the
EnvironmentConfigdocument and restart the node.External Volumes
Talos now supports virtiofs-based external volumes via the new
ExternalVolumeConfig
document.
These virtiofs external volumes are not supported when SELinux is running
in enforcing mode.
Extra Arguments accept slices in addition to strings
Several Talos configuration fields that previously accepted single string values for extra arguments have been updated to accept slices of strings as well.
This includes fields such as
.cluster.apiServer.extraArgs.BREAKING: If you were relying on the resources EtcdConfigs, KubeletConfigs, ControllerManagerConfigs, SchedulerConfigs or APIServerConfigs, the protobuf format has changed from
map<string,string>tomap<string,message>.Talos Imager Enhancements
Talos imager now supports running rootless.
--privilegedand-v /dev:/devare no longer required.Image APIs Updated
Talos Linux provides new APIs to manage container images on the node: listing, pulling, importing and removing images.
The new pull APIs provides pull progress notifications.
The CLI commands
talosctl image pull,talosctl image listandtalosctl image removehave been updated to interact with the new APIs.Talosctl images k8s-bundle subcommand accepts version parameter
The
talosctl images k8s-bundlecommand now accepts an optional version overrides arguments.Kubernetes server-side apply
Talos now uses inventory backed server-side apply when applying bootsrap manifests (including
extraManifestsandinlineManifests).Purging of unneeded manifests is automatically performed.
The switch and inventory backfill is automatic and no action is needed from the user.
KubeSpan Configuration
A new
KubeSpanConfigdocument has been introduced to configure KubeSpan settings.It replaces and deprecates the previous method of configuring KubeSpan via the
.machine.network.kubespanfield.The old configuration field will continue to work for backward compatibility.
KubeSpan Advertised Network Filters
KubeSpan now supports filtering of advertised networks using the
excludeAdvertisedNetworksfield in theKubeSpanConfigdocument.This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any
pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers,
and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.
LinkAliasConfig Pattern-Based Multi-Alias
LinkAliasConfignow supports pattern-based alias names using%dformat verb (e.g.net%d).When the alias name contains a
%dformat verb, the selector is allowed to match multiple links.Each matched link receives a sequential alias (e.g.
net0,net1, ...) based on hardware address orderof the links. Links already aliased by a previous config are automatically skipped.
This enables creating stable aliases from any N links using a single config document,
useful for
BondConfigandBridgeConfigmember interfaces on varying hardware.Negative Max Volume Size
Negative max size represents the amount of space to be left free on the device, rather than the size the volume should consume.
For example:
* a max size of "-10GiB" means the volume can grow to the available space minus 10GiB.
* a max size of "-25%" means the volume can grow to the available space minus 25%.
Flannel CNI with Network Policy Support
Talos Linux now supports optionally deploying Flannel CNI with network policy support enabled.
The network policy implementation is kube-network-policies.
To enable Flannel CNI with network policy support, use the following machine configuration patch:
(If the cluster is already running, sync the bootstrap manifests after applying the patch to deploy the new CNI configuration.)
Container Image Decompression
Talos now ships with
igzip(amd64) andpigz(arm64) to speed up container image decompression.ProbeConfig
The TCPProbeConfig configuration document allows to configure TCP probes for network reachability checks.
This allows to define a custom connectivity condition.
/proc/PID/mem Access Hardening
A new kernel parameter
proc_mem.force_override=neverhas been introduced by default to enhance system securityby preventing unwanted writes to protected process memory via
/proc/PID/mem.If the kernel parameter is removed, default behavior is restored, allowing access only if the process is traced.
Reproducible Disk Images
Talos disk images are now reproducible. Building the same version of Talos multiple times will yield
identical disk images.
Note: VHD and VMDK (Azure and VMware) images are not currently reproducible due to limitations in the underlying image creation tools.
Users verifying reproducible images should use raw images, verify checksums, and convert them to VHD/VMDK as needed.
ResolverConfig
The nameservers configuration in machine configuration now overwrites any previous layers (defaults, platform, etc.) when specified.
Previously a smart merge was performed to keep IPv4/IPv6 nameservers from lower layers if the machine configuration specified only one type.
Service Account Issuer configuration
In API Server, passing extra args with
service-account-issuerwill append them after default value.This allows easy migration, e.g. by changing
.cluster.controlPlane.endpointto new value, and keeping the old value in.cluster.apiServer.extraArgs["service-account-issuer"].talosctl images talos-bundlecan ignore reaching to the registryThe
talosctl images talos-bundlecommand now accepts optional--overlaysand--extensionsflags.If those are set to
false, the command will not attempt to reach out to the container registry to fetch the latest versions and digests of the overlays and extensions.Component Updates
Linux: 6.18.13
containerd: 2.2.1
etcd: 3.6.8
CoreDNS: 1.14.1
Kubernetes: 1.36.0-alpha.1
Flannel CNI plugin: v1.9.0-flannel1
Flannel: 0.28.1
LVM2: 2_03_38
runc: 1.4.0
systemd: 259.1
cryptsetup: 2.8.3
Tenstorrent: 2.7.0
iptables: 1.8.12
Talos is built with Go 1.26.0.
VM Hot-Add Support
Talos now includes udev rules to support hot-adding of CPUs in virtualized environments.
Contributors
Changes
221 commits
009f0d6cachore: update pkgsba56b0295feat: include hid-multitouch.ko kernel module in rootfsae29a0dccfeat: update Linux to 6.18.137cf1de279fix: bring in new version of go-cmd and go-blockdevicec8800b41efix: update path handling on talosctl cgroups0a7b6eb2cchore: test extensions8b1c974a2refactor: drop termui-widgets library5baa0028efix: add owning inventory annotation to talos manifestsd3e793d14fix: stop Kubernetes client from dynamically reloading the certs6a5a0e3bdfeat: support pattern link aliases9758bd4fefeat: update Go to 1.26e00aed0f6feat: update Kubernetes v1.36.0-alpha.1f20445ad0](https://redirect.github.com/Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.