siderolabs/omni v1.11.0-beta.0 on GitHub

Omni 1.11.0-beta.0 (2026-09-01)

Welcome to the v1.11.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Frontend Quality-of-Life Improvements

Align the UI features on the Cluster scale and Cluster create pages. Support searching by labels on Cluster scaling/create pages.

Install Disk Configs

Config Patches can no longer be used for setting Talos install disk. Starting from Talos 1.14 installation flow was changed a lot so setting the install disk in the configs will no longer work. Install disk is now defined in a separate resource and works differently for the older Talos versions.

Kubernetes Token Signing Keys

Admins can now list the keys that sign Kubernetes access tokens and delete them. Deleting one immediately invalidates every kubeconfig and OIDC token it signed, which is what it takes to pull a long-lived service account kubeconfig out of circulation before it expires.
See documentation for more details.

Recovery Admin for SAML Lockouts

auth.recoveryAdmin config, or the --recovery-admin flag can be used to elevate a user to Admin on every Omni start.
It also blocks user demotion through SAML label rules. This is the way back in when a SAML rule strips Admin from everyone. Only existing users can be promoted.

Contributors

Edward Sammut Alessi
Oguz Kilcan
Spencer Smith
Utku Ozdemir
Mateusz Urbanek
Kevin Tijssen
Andrey Smirnov
Artem Chernyshev
Orzelius
Noel Georgi
Tim Jones

Changes

103 commits

92d72412e release(v1.11.0-beta.0): prepare release
e402ff4ef chore: remove oauth2 client credentials auth for the image factory
e460ae71e fix: retry a rejected bootstrap request at the next check
b1341200b feat: authenticate PXE installation media with a download token
b7b58efe8 feat: download installation media through the boot asset API
e2ad5e43f refactor: rename the boot asset API to installation media URL
f573426e4 test: fix a race between manual machine picks and machine classes
605a83da9 fix: apply pending updates to unhealthy machines so they can recover
9b6d554a3 feat(frontend): use download tokens for installation media
2491f1437 fix(frontend): fix filter check in pending machines
fbaa7fb18 feat: regularly reconcile factory access tokens in cosi
23cc61d91 feat: add image factory token resource
1eecc480a feat: add image factory oauth2 client config
a96ef43d2 chore: bump deps and default versions
36bd2eccc fix: mark a cluster as bootstrapped only once etcd is running on the node
71ee3ad80 test: fix a race in the preserve-features machine config test
3794b1177 feat: authenticate boot asset downloads with image factory tokens
4bbd713da refactor: move the cluster and metrics controllers into their packages
ace063b53 fix: record the image factory host for machines already at target
8c003994b test: adapt the integration tests to Talos 1.14
78d56b38d chore: prepare Omni for Talos 1.14
e37ab210b test: trim redundant legacy manifest group id cases
f8b9cfc30 fix: migrate legacy weighted one-time manifest group ids
c76cf4b7c test: increase timeouts for sqlitelog cleanup tests
9630157c3 fix: correct manifest group ownership comparison
20afcdacb fix: drop numeric prefix from manifest group ids
d50ea9a57 fix: drop manifest apply-order weighting and fix stale status tracking
58d1897a2 feat(frontend): hide machine creation commands not supported by enterprise
fc8d3d150 feat(frontend): use cross-browser scroll styling
7bc0852b9 feat: proxy security reports through omni
1c6369866 fix(frontend): remove credentials from cluster create url
8c3f12d72 chore: bump deps
cbbfd9ffe chore: bump go
b024ef98a fix: change incorrect version contract for kubespan
b1ea5df26 fix: properly clean up pods of the health check jobs
cc3717ac6 fix: provide machine id consistently in provision API logs
c9d6d489b fix: add missing timeout to the version API call in the identity task
c19abe332 fix: stop a link to an exposed service from starting a login flow
80c4a4557 feat: manage the install disk with a first-class resource
d0ecc7b3f chore: rekres and bump deps
84856105e refactor(frontend): drop luxon in favor of date-fns
b6f64c6b7 chore: bump deps
ee0704f79 feat: allow listing and deleting the Kubernetes token signing keys
d7bef774d feat(frontend): add filename param to image downloads
c574e432d fix: siderolink api label
44aa6f524 test: increase test timeouts
d6b8c33e3 test: run talemu suite in both chrome and firefox
a0b13882c test: replace omni.localhost with ci.test
8378899c0 test: consolidate all host references to common.sh variables
0051462aa feat: serve infra provider boot assets through Omni
008d9300e chore: rekres and add gitattributes block
18854ce46 refactor(frontend): replace remaining update:xxx locations to v-model
270d06711 fix(frontend): fix etcd backup interval not editable
3798a6d8d feat: add a recovery admin for SAML lockouts
f2aeaa851 fix(frontend): check for navigation in preload error events
b56929e10 chore: bump deps
4c283a3bf chore: rekres and bump go
cfa05aa5a fix(frontend): fix incorrect machine route params
0f029dcec feat(frontend): add filtering and pagination to cluster scale
91a0e612d feat(frontend): use labels input in cluster create
11ecf9522 refactor(frontend): extract label completions query from input
76fc80dab test(frontend): fix a typo in test regex
bcf658e7f refactor(frontend): drop deprecated getcontext
3efa4c63c test: make integration tests pass against a non-CI Omni instance
71b3a9e41 test: fix flaky unit tests on overloaded CI runners
dbff80519 refactor(frontend): migrate machines away from tlist
4e7e354c0 refactor(frontend): migrate pending machines away from tlist
ec2028cb3 refactor(frontend): move pagination reset logic into composable
0faf1cc1c refactor(frontend): lift filtering logic out of tlist
b3845c074 refactor(frontend): lift pagination logic out of tlist
ec0098668 refactor(frontend): lift sorting logic out of tlist
b3967f439 fix(frontend): fix side panel sizing and allow control wrapping
5bed0cb85 refactor(frontend): lift sidePanel out of tlist
c2f91ee19 refactor(frontend): lift addFilterLabel out of tlist
22d0972cd refactor(frontend): use pagination component inside tlist
8bcc1ad12 refactor(frontend): use reka-ui for pagination
c1ae41c57 refactor(frontend): extract items out of pagination
4f299f8a8 refactor(frontend): rename tpagination to pagination
a98f5ac0b refactor(frontend): rename arrow-* to chevron-* and use heroicons variants
0970a6db2 fix(frontend): fix reset wizard
cc23658b0 fix: compress diffs in the machine pending updates and diff history
47845eb51 fix: force re-authentication at the IdP so logout takes effect
194c629cf fix: keep a machine's tunnel peer address stable across provisions
899128ec5 fix(frontend): return no-cache for index.html
3e01d4012 fix: don't sign users out of Omni on Kubernetes OIDC logout
4fad1c5b9 fix(frontend): add missing credentials to security pages
8c802ffd6 test(frontend): add edit patch e2e test
240964a2e fix(frontend): fix patch edit dropping fields
d9c463dcc fix: backfill the image factory host of machines enrolled before 1.10
2c70b1541 fix: bound the machine config diff by bytes, not just lines
7a847f5c2 fix(frontend): be more defensive about signup errors
dc6fa2246 chore(frontend): bump dependencies
38299fa8e test: verify upgrade drain honors grace period and aborts on failure
0a45ef095 chore: bump default versions
4d4e327d3 feat(frontend): use hostnames for machine list in delete modal
491d83ea2 feat(frontend): normalise the delete/remove text for machines
09a97cd63 feat(frontend): show config errors on all node pages
6455ba835 feat(frontend): sort talos/k8s versions newest first
a2b38563e fix(frontend): adjust kubespan quick start text
c55f2c2bd fix: never change a machine's tunnel address after registration
686be42f7 fix: log out of Omni and the IdP when /logout is opened directly
06a07defd fix: make SAML single logout survive retries and redirect binding
31e814fa3 test: add e2e-saml test class backed by a local Keycloak IdP

Changes from siderolabs/image-factory

44 commits

b54b945 release(v1.6.0): prepare release
9244e82 feat: sign installer profile when unified secureboot supported
3b58dfa feat(enterprise): add a node tokens page
82bd329 feat: add node token methods to the factory client
9312d82 feat(enterprise): add self-issued node tokens
4691e01 feat: add WithTokenSource to include bearer tokens
b115d17 chore(enterprise): drop the Auth0 Management API node-token design
6f08ed9 feat(enterprise): extend the download-token issuer to a second audience
c51ac14 feat: accept download token on /pxe/ and forward it
7252d87 chore: allow proxying IF through IF
f45ec71 fix(enterprise): read the org_id claim from if_org_id
43adb19 release(v1.5.1): prepare release
5f1f197 feat: update Talos to 1.14.0-rc.2
b7908c1 feat(enterprise): add Auth0 Management API client for node tokens
36fedd7 feat: add WithBearerToken to include m2m token
e783a3d feat(frontend): preserve whitespace for vuln descriptions
18f56f7 chore: make sure check-dirty also checks docs
196a447 fix: enforce canonical image references
26b95ca feat(enterprise): require auth0 clientID and clientSecret always
25561f7 fix: retry put when joining a failed get flight
aab14ff feat: add spdx and vex reports to factory client
dc6a9f9 feat(enterprise): theme and translate Auth0 logout/login-error pages
bd13149 release(v1.5.0): prepare release
d3c693a feat: update talos to v1.14.0-rc.1
5c9839a feat: use the CI cluster registry cache for integration tests
70e0590 feat(enterprise): add auth0 browser login
f5f3128 fix: record the status the client actually received
0d2275c feat: make download token TTL configurable
a5824c7 docs: complete user-facing API reference
dd485bd docs: document endpoint access control
6016631 test: fix two flaky checks in the enterprise integration job
f984ad8 chore: let the OIDC test server serve extra routes
f297b62 chore: update Talos to the latest version
86b0a22 fix: re-identify cached SBOM bundles per schematic
77990dc fix: schedule grype db refresh to avoid replica desync
ad14c5f feat(enterprise): publish installer build evidence
dbcc3c6 feat: add auth0 bearer token authentication
ae757b5 chore: bump cosign to v3.1.2, sign via Rekor v2 + TSA
615b279 feat(enterprise): serve detached Sigstore bundles for assets
5296d4a chore: update grpc library
dee1a57 feat: support JWT download tokens
c2339ee feat: support public routes in enterprise plugins
a81f6e9 feat: proxy images through backing registry
32a3b08 fix: reuse registry puller for bundle verification

Changes from siderolabs/siderolink

4 commits

ad296ab chore: rekres, bump deps
23030b0 fix: keep a replacement gRPC stream's send queue after cleanup
4b69f46 fix: correct the wireguard device error handling
5157d0c fix: accept valid short IPv6 packets on filtered devices

Dependency Changes

github.com/aws/aws-sdk-go-v2 v1.43.2 -> v1.44.0
github.com/aws/aws-sdk-go-v2/config v1.32.33 -> v1.32.40
github.com/aws/aws-sdk-go-v2/credentials v1.19.32 -> v1.19.39
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.7 -> v0.3.17
github.com/aws/aws-sdk-go-v2/service/s3 v1.106.2 -> v1.108.0
github.com/aws/smithy-go v1.27.6 -> v1.28.1
github.com/google/cel-go v0.31.0 new
github.com/google/go-containerregistry v0.21.8 -> v0.22.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 -> v2.30.0
github.com/russellhaering/goxmldsig v1.6.0 -> v1.6.1
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 -> v6.0.3
github.com/siderolabs/image-factory v1.4.0 -> v1.6.0
github.com/siderolabs/siderolink v0.3.16 -> v0.3.17
github.com/siderolabs/talos/pkg/machinery v1.14.0-beta.1 -> 322de8bf2974
github.com/sirupsen/logrus v1.9.4 -> v1.10.2
github.com/stretchr/testify v1.11.1 -> v1.12.1
github.com/zitadel/oidc/v3 v3.48.1 -> v3.49.3
go.yaml.in/yaml/v4 v4.0.0-rc.6 -> 643e93b9c9be
golang.org/x/crypto v0.54.0 -> v0.55.0
golang.org/x/net v0.57.0 -> v0.58.0
golang.org/x/text v0.40.0 -> v0.41.0
golang.org/x/tools v0.48.0 -> v0.49.0
google.golang.org/grpc v1.83.0 -> v1.83.2
google.golang.org/protobuf f2248ac996af -> v1.36.12
k8s.io/api v0.36.3 -> v0.37.0
k8s.io/apimachinery v0.36.3 -> v0.37.0
k8s.io/client-go v0.36.3 -> v0.37.0

Previous release can be found at v1.10.0