siderolabs/talos v0.12.0-beta.1

on GitHub

Talos 0.12.0-beta.1 (2021-08-23)

Welcome to the v0.12.0-beta.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/talos-systems/talos/issues.

Support for Self-hosted Control Plane Dropped

Note: This item only applies to clusters bootstrapped with Talos <= 0.8.

Talos 0.12 completely removes support for self-hosted Kubernetes control plane (bootkube-based).
Talos 0.9 introduced support for Talos-managed control plane and provided migration path to convert self-hosted control plane
to Talos-managed static pods.
Automated and manual conversion process is available in Talos from 0.9.x to 0.11.x.
For clusters bootstrapped with bootkube (Talos <= 0.8), please make sure control plane is converted to Talos-managed
before upgrading to Talos 0.12.
Current control plane status can be checked with talosctl get bootstrapstatus before performing upgrade to Talos 0.12.

Cluster API v0.3.x

Cluster API v0.3.x (v1alpha3) is not compatible with Kubernetes 1.22 used by default in Talos 0.12.
Talos can be configued to use Kubernetes 1.21 or CAPI v0.4.x components can be used instead.

Machine Config Validation

Unknown keys in the machine config now make the config invalid,
so any attempt to apply/edit the configuration with the unknown keys will lead into an error.

Sysctl Configuration

Sysctl Kernel Params configuration was completely rewritten to be based on controllers and resources,
which makes it possible to apply .machine.sysctls in immediate mode (without a reboot).
talosctl get kernelparams returns merged list of KSPP, Kubernetes and user defined params along with
the default values overwritten by Talos.

Equinix Metal

Added support for Equinix Metal IPs for the Talos virtual (shared) IP (option equnixMetal under vip in the machine configuration).
Talos automatically re-assigns IP using the Equinix Metal API when leadership changes.

etcd

New etcd cluster members are now joined in learner mode, which improves cluster resiliency
to member join issues.

Join Node Type

Node type join was renamed to worker for clarity. The old value is still accepted in the machine configuration but deprecated.
talosctl gen config now generates worker.yaml instead of join.yaml.

Networking

• multiple static addresses can be specified for the interface with new .addresses field (old .cidr field is deprecated now)
• static addresses can be set on interfaces configured with DHCP

Performance

• machined uses less memory and CPU time
• more disk encryption options are exposed via the machine configuration
• disk partitions are now aligned properly with minimum I/O size
• Talos system processes are moved under proper cgroups, resource metrics are now available via the kubelet
• OOM score is set on the system processes making sure they are killed last under memory pressure

Security

• etcd PKI moved to /system/secrets
• kubelet bootstrap CSR auto-signing scoped to kubelet bootstrap tokens only
• enforce default seccomp profile on all system containers
• run system services apid, trustd, and etcd as non-root users

Component Updates

• Linux: 5.10.58
• Kubernetes: 1.22.1
• containerd: 1.5.5
• runc: 1.0.1
• GRUB: 2.06
• Talos is built with Go 1.16.7

Kubernetes Upgrade

talosctl upgrade-k8s now checks if cluster has any resources which are going to be removed or migrated to the new version after upgrade
and shows that as a warning before the upgrade.
Additionally, upgrade-k8s command now has --dry-run flag that only prints out warnings and upgrade summary.

Contributors

• Andrey Smirnov
• Andrey Smirnov
• Alexey Palazhchenko
• Serge Logvinov
• Artem Chernyshev
• Spencer Smith
• Artem Chernyshev
• Alexey Palazhchenko
• dependabot[bot]
• Andrew Rynhard
• Noel Georgi
• Rui Lopes
• Caleb Woodbine
• Seán C McCord

Changes

Changes since v0.12.0-beta.0

Changes from talos-systems/crypto

Changes from talos-systems/extras

Changes from talos-systems/go-blockdevice

Changes from talos-systems/pkgs

Changes from talos-systems/tools

Dependency Changes

• github.com/BurntSushi/toml v0.3.1 -> v0.4.1
• github.com/aws/aws-sdk-go v1.38.66 -> v1.40.2
• github.com/containerd/containerd v1.5.2 -> v1.5.5
• github.com/cosi-project/runtime 93ead370bf57 -> 25f235cd0682
• github.com/docker/docker v20.10.7 -> v20.10.8
• github.com/google/uuid v1.2.0 -> v1.3.0
• github.com/hashicorp/go-getter v1.5.4 -> v1.5.7
• github.com/opencontainers/runtime-spec e6143ca7d51d -> 1c3f411f0417
• github.com/packethost/packngo v0.19.0 new
• github.com/prometheus/procfs v0.6.0 -> v0.7.2
• github.com/rivo/tview d4fb0348227b -> 29d673af0ce2
• github.com/spf13/cobra v1.1.3 -> v1.2.1
• github.com/talos-systems/crypto v0.3.1 -> v0.3.2
• github.com/talos-systems/extras v0.4.0 -> v0.5.0
• github.com/talos-systems/go-blockdevice v0.2.1 -> v0.2.3
• github.com/talos-systems/pkgs v0.6.0-1-g7b2e126 -> v0.7.0
• github.com/talos-systems/tools v0.6.0 -> v0.7.0
• github.com/vmware-tanzu/sonobuoy v0.52.0 -> v0.53.1
• go.uber.org/zap v1.17.0 -> v1.19.0
• golang.org/x/net 04defd469f4e -> 853a461950ff
• golang.org/x/sys 59db8d763f22 -> 0f9fa26af87c
• golang.org/x/time 38a9dc6acbc6 -> 1f47c861a9ac
• google.golang.org/grpc v1.38.0 -> v1.40.0
• google.golang.org/protobuf v1.26.0 -> v1.27.1
• inet.af/netaddr bf05d8b52dda -> ce7a8ad02cc1
• k8s.io/api v0.21.2 -> v0.22.1
• k8s.io/apimachinery v0.21.2 -> v0.22.1
• k8s.io/apiserver v0.21.2 -> v0.22.1
• k8s.io/client-go v0.21.2 -> v0.22.1
• k8s.io/cri-api v0.21.2 -> v0.22.1
• k8s.io/kubectl v0.21.2 -> v0.22.1
• k8s.io/kubelet v0.21.2 -> v0.22.1

Previous release can be found at v0.11.0

Images

quay.io/coreos/flannel:v0.13.0
ghcr.io/talos-systems/install-cni:v0.5.0
docker.io/coredns/coredns:1.8.4
gcr.io/etcd-development/etcd:v3.4.16
k8s.gcr.io/kube-apiserver:v1.22.1
k8s.gcr.io/kube-controller-manager:v1.22.1
k8s.gcr.io/kube-scheduler:v1.22.1
k8s.gcr.io/kube-proxy:v1.22.1
ghcr.io/talos-systems/kubelet:v1.22.1
ghcr.io/talos-systems/installer:v0.12.0-beta.1
k8s.gcr.io/pause:3.2