github siderolabs/omni v1.13.0-beta.0
on GitHub

pre-release4 hours ago

Omni 1.13.0-beta.0 (2026-10-21)

Welcome to the v1.13.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)

The BoltDB storage backend (storage.default.kind: boltdb, --storage-kind boltdb) is deprecated and will be removed in a future release. It keeps working in this release and Omni logs a warning at startup when it runs on it. There is no automated migration between the two backends, so if your Omni runs on BoltDB, plan the move to etcd, which is the default, before the removal lands.

The metrics endpoint now listens on 127.0.0.1:2122 by default instead of 0.0.0.0:2122. If you scrape the Omni metrics from another host or from outside the Omni container (e.g., through a published Docker port), set services.metrics.endpoint (--metrics-bind-addr) to 0.0.0.0:2122 explicitly. The Helm chart still binds it to 0.0.0.0:2122 when metrics.enabled is set.

The embedded etcd server no longer listens on any address by default, Omni connects to it in-memory. Previously, it listened on storage.default.etcd.endpoints (http://localhost:2379 by default) without TLS, and backups taken with etcdctl relied on it. To access the embedded etcd from outside, set storage.default.etcd.embeddedCertFile and embeddedKeyFile (--etcd-embedded-cert-path, --etcd-embedded-key-path), and optionally embeddedCaFile (--etcd-embedded-ca-path). The embedded etcd server then listens on the storage.default.etcd.endpoints addresses with TLS, and only accepts clients with a certificate signed by the given CA. When no CA is set, the certificate file must contain a single certificate, which is used as the CA, so clients can use the same certificate and key.

Client Address in Audit Logs

Audit log entries now record the address of the client that made the request. This includes requests to the Kubernetes proxy. The audit log page shows the address next to the actor.

Config Changes Applied in Try Mode

On machines running Talos 1.14 or later, Omni now applies config changes in try mode. It confirms a change only when the machine is still reachable after it. When a config patch cuts a machine off from Omni (e.g., incorrect network configuration), Talos rolls it back, and the machine does not stay unreachable.

After 2 rolled back attempts, Omni stops and reports the error on the machine. Changing the config starts over. The first config, which takes a machine out of maintenance mode, is still applied without try mode.

Errors when applying a config to a machine in maintenance mode are now shown in the machine list and on the machine details page.

Default Version Label

The TalosVersion and KubernetesVersion resources that Omni uses as its defaults now carry the omni.sidero.dev/default-version label. Clients can find the default versions with a label query.

Upgrades Between Unsupported Talos Versions in Maintenance

A machine in maintenance mode that runs a Talos version Omni no longer supports can now be upgraded to another unsupported version. This way, an old machine can go through the intermediate versions Talos requires (e.g., 1.7 to 1.8 to 1.9) until it reaches a supported one.

EULA Acceptance

The EULA page in the UI is removed. The End User License Agreement is now accepted with the --eula-accept-name and --eula-accept-email flags (eulaAccept in the config file, config.eulaAccept in the Helm chart).

Omni does not start until the EULA is accepted. Once accepted, it stays accepted, so a new installation needs the flags only on its first start. Setting them again with different values updates the stored name and email. Installations that already accepted the EULA need no changes.

UI Improvements

The UI marks the Talos versions served from an enterprise image factory. The enterprise label is also shown on the cluster overview and in the Talos update, upgrade and install dialogs.

The cluster security page now says why scans are not available: either the cluster does not run enterprise images, or the factory has no scan report for its schematic yet. Installation media downloads show a loading state, and a message when the enterprise factory does not support the selected Talos version.

Every page has its own browser tab title, e.g., "Overview · my-cluster · Clusters · Omni". The version selectors group Talos versions by minor version. Users with no avatar from the identity provider get one generated from their name or email.

SideroLink Join Configuration in the Schematic

Every machine's schematic now carries its SideroLink join configuration, so an install or a Talos upgrade no longer loses the connection to Omni when the join args were only on the machine's kernel command line. From Talos 1.12 on, the join configuration is embedded machine configuration instead of kernel args, also in new installation media. Existing machines move to the new schematic at their next install or upgrade. Deploying this release does not install, upgrade or reboot any machine. Each cluster member gets one config update without a reboot, as the install image in its config changes to the new schematic.

If you give Talos 1.12+ machines their configuration through another source, such as cloud user-data, the talos.config URL, or the talos.config.early and talos.config.inline kernel args, include the join documents in it (omnictl jointoken machine-config prints them), since that configuration replaces the embedded one.

The new omni_machine_siderolink_join_config metric counts the machines by where their SideroLink join configuration is: embedded_config, kernel_args, machine_config or unknown. It shows how many machines already have the join configuration in their schematic.

Machine Labels Through Join Tokens

A join token can now carry machine labels, set with omnictl jointoken machine-config|kernel-args --set-labels key=value. A machine that joins with such a token gets these labels as user labels, so they can be changed later like any other user label. A machine that already has user labels keeps them.

Local Resource Service Removal

The local resource service, which served Omni resources on a local listener, is removed. Consumers should reach Omni through its regular API with a service account instead. Its services.localResourceService settings and flags have no effect.

Minimum Talos Version

New clusters now require Talos 1.10.0 or later. The minimum was 1.9.0 before.

OIDC Identity Labels and Roles

OIDC logins now get identity labels, like SAML logins. The groups and roles claims of the ID token become labels on the identity, e.g., oidc.omni.sidero.dev/groups/devs. They are synced on every login. The existing SAMLLabelRule resources apply to these labels too, so a rule assigns a role to an OIDC user the same way it does to a SAML user.

By default, OIDC users are still not created on their first login. To create them like SAML users, set auth.oidc.autoCreateUsers (--auth-oidc-auto-create-users). Only do this when every account of the identity provider belongs to the organization.

The labels are shown in the users list of the UI and in omnictl user list.

Identity Provider Session Reuse

Every new public key (for the UI, the CLI or the workload proxy) requires a fresh login at the identity provider. Setting auth.requireReauthForNewKeys: false lets the identity provider reuse its existing session instead, while the first login after an Omni logout still requires a fresh one. This lowers security, so only turn it off when the identity provider limits how long its sessions last.

With the setting on, Omni logs a warning when an OIDC or SAML identity provider ignores the request for a fresh login. Additionally, with OIDC, Omni now only accepts an ID token issued in the last few minutes to confirm a new key.

Resource Browser

The UI has a new resource browser. It lists every Omni and Talos resource the user can read, with search and export, and is meant for debugging.

Signed SAML Requests

Omni can now sign the SAML AuthnRequest and LogoutRequest. To enable it, register a certificate at the identity provider, then set auth.saml.certFile and auth.saml.keyFile (--auth-saml-cert, --auth-saml-key). Omni publishes the certificate in /saml/metadata.

The LogoutRequest is sent over the HTTP-Redirect binding when the identity provider supports it, and over HTTP-POST otherwise.

Secrets Through Environment Variables

The OIDC client secret can now be set with the OMNI_AUTH_OIDC_CLIENT_SECRET environment variable, like the image factory passwords.

The flags that take a secret as their value are deprecated: --auth-oidc-client-secret, --primary-factory-password, --secondary-factory-password and --image-factory-password. Use the environment variables or a config file instead. --config-path can be given more than once, and the files are merged.

Service Account Key Revocation

A single key of a service account can now be revoked, and the service account and its other keys stay. Use omnictl serviceaccount revoke-key <name> <public-key-id>, or the list of keys on the service accounts page in the UI.

UI Design Refresh and Themes

The UI now uses the fonts and colors of the Talos design system. Each status has its own glyph, so states differ in shape and not only in color. Labels are neutral, with a glyph for their group.

The UI now has a light theme, and a second dark theme, Dim, which uses Omni's original blue-grey colors. The theme menu at the right end of the top bar offers Light, Dark, Dim and System. System is the default and follows the operating system.

Config history and pending updates use a new diff view with split and inline modes. Code blocks have syntax highlighting.

Contributors

  • Utku Ozdemir
  • Edward Sammut Alessi
  • Oguz Kilcan
  • Mateusz Urbanek
  • Andrey Smirnov
  • Sterling Koch
  • immanuwell
  • Artem Chernyshev
  • Andy Longwill
  • Maja Bojarska
  • Matt Van Horn
  • Oscar Wieman
  • Olli Hauer
  • Steve Wills

Changes

145 commits

  • b423fa6a release(v1.13.0-beta.0): prepare release
  • d990cf7e feat: read /proc/cmdline on machines without the KernelCmdline resource
  • 6611f41d feat: add a metric for where the SideroLink join config of machines is
  • b658048e feat: move the SideroLink join config into the machine schematic
  • 0468ea01 feat: rekres and specify js.Toolchain extraPackages
  • f8bfdb4a fix: mount node_modules in a dedicated volume for compose
  • 555bd2e6 chore: bump deps
  • d6b38662 chore: bump default and minimum talos versions
  • 865a315c chore: rekres and bump go
  • f8f13618 fix: honor TTL flags for service account keys
  • 7911b2ca fix: generate the join config by the running Talos version
  • 38eac0d3 test: retry the ConfigMap update in the advanced healthcheck test
  • 814962f8 fix: add missing context timeout to the delete upgrade meta key call
  • 41cadf21 fix: validate label selectors of access policies
  • b19d5e42 feat: sync identity labels and roles from OIDC claims
  • 4adde371 fix: keep the CLI key of a user created by the login
  • a52d8778 feat(frontend): listen for patch creation on kubespan page
  • e8881693 fix: preserve the initial versions of an imported cluster
  • 7eb8d7bd feat: accept the EULA only with flags
  • b67b2496 chore(frontend): bump frontend dependencies
  • c11e4e05 refactor: use the Talos client factory directly for internal callers
  • 91592a27 test: use testutils.WithRuntime for machine teardown test
  • 1b9f57fc fix: skip machine wipe when the machine is disconnected
  • ab474432 feat: apply config changes in try mode on Talos 1.14 and later
  • 5adabd78 fix: preserve the recovery file when omnictl edit is canceled
  • 4d3eba50 feat: record the client address in audit logs
  • 8c45aaf9 test: fix two flakes in the integration tests
  • e23680fe feat: allow TLS access to the embedded etcd
  • f5c95144 feat: connect to the embedded etcd in-memory
  • b889e9d4 fix(frontend): fix incorrect ul color on installation media wizard
  • 6b31aaa2 chore(frontend): allow customizing dev server host
  • 49b61b7d refactor(frontend): move specific spacing onto design system spacing
  • 79884c9d refactor(frontend): switch to design system spacing
  • a57d5e91 fix: limit the public key registrations per source address
  • c048e285 feat(frontend): use design system fonts
  • c381e12b fix: bind the metrics endpoint to localhost by default
  • 770817f3 fix: do not trust client-sent X-Forwarded-For entries
  • b45aea18 feat: allow reusing the identity provider session for new keys
  • 10b46bb5 chore: rekres and bump go
  • 0cb223c9 feat(frontend): add list of keys to service accounts page
  • b124cf64 feat(omnictl): add a revoke-key command to omnictl service accounts
  • 62fa33a7 feat: add grpc method for revoking a service account key
  • 1de34f43 fix: keep registered public keys in memory until they are confirmed
  • 75bf1484 fix: do not forward the workload proxy cookies to the exposed service
  • 801d26f2 chore: remove unused code
  • e6edbd3c chore: remove the auth disabled code path
  • 3f001d73 chore: deprecate the boltdb storage backend
  • dc8e57a2 fix: restore the grpc scheme of the default machine API URL
  • ef6fa4bc fix: return only the unauthenticated error for an unsigned request
  • ad590da9 feat: add an env var for the OIDC client secret, deprecate the secret flags
  • a09249b9 fix: redact config secrets and clear the stored OIDC client secret
  • c602da5d fix: forward only known headers to the Kubernetes apiserver
  • 6ce453e5 refactor(frontend): inline all icons
  • 3cce6c5b chore(frontend): remove unused components
  • 46359a48 refactor(frontend): drop heroicons and standardize icons
  • 6a17a14f fix: remove conflicting join token renew alias
  • ca2dbb06 chore: bump deps
  • 64f095ad chore: bump default versions
  • 25932e76 refactor: drop the per-key role
  • d9b2a064 fix: replace incorrect design system release
  • 304d438e fix: require a confirmed key for workload proxy access
  • 46b6481f chore(frontend): use talos-design-system lint rules
  • e7898764 chore(frontend): remove old unused icons
  • 9ce034c0 fix(frontend): fix sizing of no connection icon
  • fbfe3b89 feat(frontend): add Dim, a second dark theme
  • 6bae87d9 feat(frontend): add the light theme and a light, dark and system theme menu
  • 420858f5 fix: make a resource's cluster label agree with its target
  • 0d276077 fix: extract the cluster ID from label query terms correctly
  • c12f7181 fix(frontend): draw hover, disabled, focus and scrim states with color roles
  • a0644fbe fix(frontend): give cards a border
  • 8200e8d9 feat: allow upgrading one deprecated Talos to another one in maintenance
  • 2f90c334 fix: do not allocate machines with outdated schematics into a cluster
  • e48c13c0 fix(frontend): move code, diffs and search matches onto the syntax and highlight roles
  • a7d49689 feat(frontend): make labels neutral chips with a glyph per group
  • 06d44673 feat: sign SAML requests and the SLO cookie
  • b10a3c8c fix: reject unknown Talos versions on the talosctl downloads endpoint
  • 1d9d02d0 feat: remove the local resource service
  • cddaf5d4 fix(frontend): color chart segments by state, and by series otherwise
  • fbc37b69 chore(frontend): bump dependencies
  • a1a826f7 chore: bump go.opentelemetry.io/otel/exporters/otlp/otlptrace
  • 67d56d21 fix: resolve node headers only for the runtime that uses them
  • c181ad30 feat(frontend): render statuses as pills with a glyph per state
  • 537f1ea7 fix: read local resource server stream metadata from its own context
  • 47af5b36 fix: verify the caller before reporting a resolution failure
  • 8aed896b fix: check access before rejecting a request that names several nodes
  • 9af87e6c fix: record the outcome of Talos access in the audit log
  • 540c4c42 fix: parse the role of a public key request before any lookup
  • e202dcef refactor(frontend): rename palette classes to design system color roles
  • daed1f4a chore(frontend): vendor the Talos design system color tokens
  • 7f49d7c2 fix: return only the access error for a denied request
  • efb2b313 fix: return the same error for a missing and an inaccessible target
  • 50c54240 fix(frontend): add v prefix to installer image tag
  • aec660d6 fix(frontend): make some style fixes on cluster list
  • 1add4ee3 feat(frontend): add a resource browser to the UI
  • fb8ed2a8 fix: reconnect machines which lose META during the Talos install
  • 0c92a23f fix(frontend): check kubespanlink instead of kubespanconfig
  • 8a33e78e chore: rekres and skip the frontend build output in the license check
  • 8ef475fe fix: do not allow concurrent upgrades for talos and kubernetes
  • b7f2441d fix: cache the schematics Omni ensures on the image factories
  • e93ef2a8 fix: allow the Talos MD and LVM teardown APIs
  • 1551ae75 feat: label the default Talos and Kubernetes versions
  • df7cf37d fix: assign a new SideroLink address when the WireGuard key changes
  • 48317b5e fix: allow dotted output directories in omnictl downloads
  • ca06102b fix: manage the lifetime of the cached Talos clients with explicit leases
  • 512c3f6a fix: don't give a pending machine the address of another machine's link
  • f2a84e3f feat(frontend): add enterprise labels to maintenance modals
  • c6d27890 refactor(frontend): replace apexcharts with d3.js
  • 742e3493 refactor(frontend): rewrite RadialBar to use SVGs
  • 9a4993fe fix: ignore the ACS query for unsolicited SAML responses
  • 9537978d fix: keep the cached Talos clients alive while they are in use
  • b601b93c feat(frontend): add syntax highlighting to code block
  • 77eb3909 fix: reject unknown omnictl config contexts
  • 3b21eba7 feat(frontend): use @pierre/diffs for config history
  • f2d2634a refactor(frontend): migrate TButtonGroup to reka-ui
  • e92fa49c fix: stop the upgrade loop caused by protected args in KernelArgs
  • 4c90feb9 fix: do not report k8s manifests as deleting when Omni does not own them
  • 383a9251 feat(frontend): add page titles to all omni pages
  • d022e670 fix(frontend): show enterprise label for cluster on overview
  • d5c5168c feat(frontend): show a generic text based fallback avatar
  • a5ac0271 fix: forbid changing roles to or from InfraProvider
  • ad7039c7 fix: honor context override in omnictl config info
  • dd2a7e63 feat: support adding user labels through join tokens
  • d2f3a105 refactor(frontend): replace some detached scopes with createSharedComposable
  • 4d136658 test(frontend): add e2e-talemu suite for enterprise tests
  • feb98267 fix: stop using the plain Talos installer image for installs
  • 52b75392 fix: do not keep a stale schematic ID for machines not yet installed
  • b09a7028 fix: correct handling of Wireguard peers and tunnel mode
  • 8c20c4f6 feat: validate undefined group references in AccessPolicy rules
  • 9eeeb0e5 chore: bump deps, rekres, Talos 1.14.1, Kubernetes 1.37.0
  • e4041f80 test: add the image factory migration integration test
  • 4d2ec274 feat(frontend): show a message that cluster security UI requires enterprise
  • 2c5757ba feat(frontend): add enterprise label to cluster overview
  • e2393ba4 feat: copy enterprise label to more resources
  • 597a2a7f feat(frontend): handle not found scan reports in ui
  • ee6fbebb fix(frontend): make security docs link _blank
  • af38fa7e feat(frontend): group talos versions by minor
  • b07c96b1 feat(frontend): add enterprise label to talos select lists
  • 9e2860ec refactor(frontend): extract all select components into individual files
  • 93425e99 refactor(frontend): create a singular talos version select component
  • 299ebeca fix: allow image removal API
  • 83658d3b fix: remove incomplete installation media downloads
  • e9e00a62 feat(frontend): add loading state for image download links
  • 9b09485e refactor: normalize factory urls at input only
  • a8e640ce fix: keep the untouched machines out of a canceled Talos upgrade
  • bcc5bb86 test: drop MinIO usage in the tests

Changes from siderolabs/discovery-service

7 commits

  • 1f4c8c9 release(v1.1.3): prepare release
  • 828e951 fix: do not report live affiliates as deleted on endpoint expiry
  • 90d0dca release(v1.1.2): prepare release
  • 293c000 feat: optimize memory usage of Discovery Service
  • dedbdb1 chore: update golang, direct deps, generate
  • 3f6e594 chore: rekres
  • 14ae016 feat: add flag to configure log level

Changes from siderolabs/gen

2 commits

  • cbd9518 chore: rekres and update deps
  • 26ccee1 feat: provide new YAMl unmarshal validator for null values

Changes from siderolabs/go-kubernetes

2 commits

  • 1a7f4fb fix: set a logger on the ssa controller-runtime client
  • f752bb3 feat: add Kubernetes 1.38 compatibility

Changes from siderolabs/image-factory

21 commits

  • f3d984d release(v1.7.2): prepare release
  • 79b67d7 chore: add cdn hmac verification
  • a54d48a refactor(http): remove shared dependency bag
  • 983ec95 refactor(http): isolate registry services
  • 015a950 refactor(http): isolate OCI routing
  • 58b4086 refactor(http): isolate browser adapters
  • df928e0 refactor(http): isolate image services
  • 7c5173e refactor(http): unify route authentication
  • 55a9fff refactor(http): isolate endpoint owners
  • ae77d98 feat(http): declare route ownership
  • be369f1 refactor(http): declare route metadata
  • 77ecb9e release(v1.7.1): prepare release
  • fec432d feat: update dependencies
  • c99ce3a feat: improve the token UI
  • 73f93b2 test: switch to SeaweedFS instead of minio for testing
  • c35986a feat: add 'On Premises' role to the token UI
  • 42d9b84 fix(scanner): wait for database replacement
  • feaf2f6 fix: download 1.14.0
  • 5da8c30 release(v1.7.0): prepare release
  • 513036c fix: cache unauthenticated iPXE scripts, dedupe cache signing
  • 5fec48b test: characterize HTTP frontend behavior

Changes from siderolabs/siderolink

2 commits

  • 755a982 chore: update dependencies and rekres
  • 5d6e09f fix: rework keying of the streams to the peers

Dependency Changes

  • cel.dev/cel-go v0.32.0 new
  • github.com/ProtonMail/go-crypto v1.4.1 -> v1.5.2
  • github.com/ProtonMail/gopenpgp/v3 v3.4.1 -> v3.5.2
  • github.com/auth0/go-jwt-middleware/v3 v3.3.0 -> v3.4.0
  • github.com/aws/aws-sdk-go-v2 v1.46.0 -> v1.47.3
  • github.com/aws/aws-sdk-go-v2/config v1.33.3 -> v1.33.9
  • github.com/aws/aws-sdk-go-v2/credentials v1.20.3 -> v1.20.9
  • github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.4.3 -> v0.4.17
  • github.com/aws/aws-sdk-go-v2/service/s3 v1.111.0 -> v1.114.3
  • github.com/aws/smithy-go v1.28.1 -> v1.28.5
  • github.com/beevik/etree v1.8.1 new
  • github.com/cenkalti/backoff/v7 v7.0.1 new
  • github.com/dustin/go-humanize v1.0.1 -> v1.1.0
  • github.com/fluxcd/cli-utils v1.3.0 -> v1.4.0
  • github.com/fluxcd/pkg/ssa v0.77.0 -> v0.80.0
  • github.com/go-jose/go-jose/v4 v4.1.5 -> v4.1.6
  • github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 -> v2.32.0
  • github.com/mattn/go-shellwords v1.0.14 -> v1.0.16
  • github.com/prometheus/client_golang v1.24.1 -> v1.25.0
  • github.com/prometheus/common v0.71.0 -> v0.72.1
  • github.com/siderolabs/discovery-service v1.1.1 -> v1.1.3
  • github.com/siderolabs/gen v0.8.7 -> v0.8.8
  • github.com/siderolabs/go-kubernetes v0.2.41 -> v0.2.43
  • github.com/siderolabs/image-factory 4520b38a89a6 -> v1.7.2
  • github.com/siderolabs/siderolink v0.3.17 -> v0.3.18
  • github.com/siderolabs/talos/pkg/machinery 5c5fd29e95f7 -> v1.15.0-alpha.1
  • github.com/stripe/stripe-go/v86 v86.4.2 new
  • github.com/zitadel/oidc/v3 v3.49.6 -> v3.51.16
  • go.etcd.io/etcd/client/pkg/v3 v3.7.1 -> v3.7.2
  • go.etcd.io/etcd/client/v3 v3.7.1 -> v3.7.2
  • go.etcd.io/etcd/pkg/v3 v3.7.1 -> v3.7.2
  • go.etcd.io/etcd/server/v3 v3.7.1 -> v3.7.2
  • golang.org/x/crypto v0.56.0 -> v0.58.0
  • golang.org/x/net v0.58.0 -> v0.61.0
  • golang.org/x/oauth2 v0.36.0 -> v0.37.0
  • golang.org/x/sync v0.22.0 -> v0.24.0
  • golang.org/x/text v0.41.0 -> v0.43.0
  • golang.org/x/time v0.15.0 -> v0.16.0
  • golang.org/x/tools v0.49.0 -> v0.52.0
  • golang.zx2c4.com/wireguard ecfc5a8d5446 -> 2631ce99a06f
  • google.golang.org/grpc v1.83.2 -> v1.84.0
  • k8s.io/api v0.37.0 -> v0.37.1
  • k8s.io/apimachinery v0.37.0 -> v0.37.1
  • k8s.io/client-go v0.37.0 -> v0.37.1
  • sigs.k8s.io/controller-runtime v0.25.0 -> v0.25.2

Previous release can be found at v1.12.0

Check out latest releases or
releases around siderolabs/omni v1.13.0-beta.0

Don't miss a new omni release

NewReleases is sending notifications on new releases.

Get notifications