siderolabs/talos v0.14.0

on GitHub

Talos 0.14.0 (2021-12-21)

Welcome to the v0.14.0 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/talos-systems/talos/issues.

Kexec and capabilities

When kexec support is disabled
Talos no longer drops Linux capabilities (CAP_SYS_BOOT and CAP_SYS_MODULES) for child processes.
That is helpful for advanced use-cases like Docker-in-Docker.

If you want to permanently disable kexec and capabilities dropping, pass kexec_load_disabled=1 argument to the kernel.

For example:

install:
  extraKernelArgs:
    - sysctl.kernel.kexec_load_disabled=1

Please note that capabilities are dropped before machine configuration is loaded,
so disabling kexec via machine.sysctls will not be enough.

Cluster Discovery

Cluster Discovery is enabled by default for Talos 0.14.
Cluster Discovery can be disabled with talosctl gen config --with-cluster-discovery=false.

installer and imager images

Talos supports two target architectures: amd64 and arm64, so all Talos images are built for both amd64 and arm64.

New image imager was added which contains Talos assets for both architectures which allows to generate Talos disk images
cross-arch: e.g. generate Talos Raspberry PI disk image on amd64 machine.

As installer image is used only to do initial install and upgrades, it now contains Talos assets for a specific architecture.
This reduces size of the installer image leading to faster upgrades and less memory usage.

There are no user-visible changes except that now imager container image should be used to produce Talos disk images.

Kubelet

Kubelet configuration can be updated without node restart (.machine.kubelet section of machine configuration) with commands
talosctl edit mc --immediate, talosctl apply-config --immediate, talosctl patch mc --immediate.

Kubelet service can now be restarted with talosctl service kubelet restart.

Kubelet node IP configuration (.machine.kubelet.nodeIP.validSubnets) can now include negative subnet matches (prefixed with !).

Log Shipping

Talos can now ship system logs
to the configured destination using either JSON-over-UDP or JSON-over-TCP:
see .machine.logging machine configuration option.

NTP Sync

Talos NTP sync process was improved to align better with kernel time adjustment periods and to filter out spikes.

SideroLink

A set of Talos ehancements is going to unlock a number of exciting features in the upcoming release of Sidero:

• SideroLink: a point-to-point Wireguard tunnel connecting Talos node back to the provisioning platform (Sidero).
• event sink (kernel arg talos.event.sink=http://10.0.0.1:4000) delivers Talos internal events to the specified destination.
• kmsg log delivery (kernel arg talos.logging.kernel=tcp://10.0.0.1:4001) sends kernel logs as JSON lines over TCP or UDP.

talosctl support

talosctl CLI tool now has a new subcommand called support, that can gather all
cluster information that could help with future debugging in a single run.

Output of the command is a zip archive with all talos service logs, kubernetes pod logs and manifests,
talos resources manifests and so on.
Generated archive does not contain any secret information so it is safe to send it for analysis to a third party.

Component Updates

• Linux: 5.15.6
• etcd: 3.5.1
• containerd: 1.5.8
• runc: 1.0.3
• Kubernetes: 1.23.1
• CoreDNS: 1.8.6
• Flannel (default CNI): 0.15.1

Talos is built with Go 1.17.5

Kubernetes Upgrade Enhancements

talosctl upgrade-k8s was improved to:

• sync all boostrap manifest resources in the Kubernetes cluster with versions bundled with current version Talos
• upgrade kubelet to the version of the control plane components (without node reboot)

So there is no need to update CoreDNS, Flannel container manually after running upgrade-k8s anymore.

VLAN Enhancements

Talos now supports setting MTU and Virtual IPs on VLAN interfaces.

Contributors

• Andrey Smirnov
• Alexey Palazhchenko
• Artem Chernyshev
• Noel Georgi
• Serge Logvinov
• Nico Berlee
• Spencer Smith
• Alex Zero
• Andrew Rynhard
• Branden Cash
• David Haines
• Gerard de Leeuw
• Michael Fornaro
• Rohit Dandamudi
• Rui Lopes
• Seán C McCord

Changes

Changes since v0.14.0-beta.1

Changes from talos-systems/discovery-api

Changes from talos-systems/discovery-client

Changes from talos-systems/extras

Changes from talos-systems/go-blockdevice

Changes from talos-systems/go-smbios

Changes from talos-systems/net

Changes from talos-systems/pkgs

Changes from talos-systems/siderolink

Changes from talos-systems/tools

Dependency Changes

• github.com/AlekSi/pointer v1.1.0 -> v1.2.0
• github.com/cenkalti/backoff/v4 v4.1.2 new
• github.com/containerd/cgroups v1.0.1 -> v1.0.2
• github.com/containerd/containerd v1.5.5 -> v1.5.8
• github.com/cosi-project/runtime 5cb7f5002d77 -> 264f8fcd1a4f
• github.com/docker/docker v20.10.8 -> v20.10.11
• github.com/evanphx/json-patch v4.11.0 -> v5.6.0
• github.com/gosuri/uiprogress v0.0.1 new
• github.com/hashicorp/go-getter v1.5.8 -> v1.5.9
• github.com/hetznercloud/hcloud-go v1.32.0 -> v1.33.1
• github.com/insomniacslk/dhcp b95caade3eac -> 5297eed8f489
• github.com/jsimonetti/rtnetlink 435639c8e6a8 -> fd9a11f42291
• github.com/jxskiss/base62 4f11678b909b -> v1.0.0
• github.com/mdlayher/ethtool 2b88debcdd43 -> 288d040e9d60
• github.com/mdlayher/netlink v1.4.1 -> v1.4.2
• github.com/packethost/packngo v0.19.1 -> v0.20.0
• github.com/rivo/tview ee97a7ab3975 -> 2a6de950f73b
• github.com/talos-systems/discovery-api v0.1.0 new
• github.com/talos-systems/discovery-client v0.1.0 new
• github.com/talos-systems/extras v0.6.0 -> v0.7.0-1-gd6b73a7
• github.com/talos-systems/go-blockdevice v0.2.4 -> v0.2.5
• github.com/talos-systems/go-smbios v0.1.0 -> v0.1.1
• github.com/talos-systems/net v0.3.0 -> v0.3.1
• github.com/talos-systems/pkgs v0.8.0 -> v0.9.0-1-g7a3419a
• github.com/talos-systems/siderolink v0.1.0 new
• github.com/talos-systems/tools v0.8.0 -> v0.9.0-1-gb1146f9
• github.com/vmware-tanzu/sonobuoy v0.53.2 -> v0.55.1
• github.com/vmware/govmomi v0.26.1 -> v0.27.2
• github.com/vmware/vmw-guestinfo 687661b8bd8e -> cc1fd90d572c
• go.etcd.io/etcd/api/v3 v3.5.0 -> v3.5.1
• go.etcd.io/etcd/client/pkg/v3 v3.5.0 -> v3.5.1
• go.etcd.io/etcd/client/v3 v3.5.0 -> v3.5.1
• go.etcd.io/etcd/etcdutl/v3 v3.5.0 -> v3.5.1
• go.uber.org/atomic v1.9.0 new
• golang.org/x/net 3ad01bbaa167 -> 491a49abca63
• golang.org/x/sys 39ccf1dd6fa6 -> 97ca703d548d
• golang.org/x/term 140adaaadfaf -> 03fcf44c2211
• golang.org/x/time 1f47c861a9ac -> f0f3c7e86c11
• golang.zx2c4.com/wireguard/wgctrl 0a2f4901cba6 -> dd7407c86d22
• google.golang.org/grpc v1.41.0 -> v1.42.0
• inet.af/netaddr 85fa6c94624e -> c74959edd3b6
• k8s.io/api v0.22.2 -> v0.23.1
• k8s.io/apimachinery v0.22.2 -> v0.23.1
• k8s.io/client-go v0.22.2 -> v0.23.1
• k8s.io/component-base v0.23.1 new
• k8s.io/cri-api v0.22.2 -> v0.23.1
• k8s.io/kubectl v0.22.2 -> v0.23.1
• k8s.io/kubelet v0.22.2 -> v0.23.1
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.59 -> v1.2.61
• sigs.k8s.io/yaml v1.3.0 new

Previous release can be found at v0.13.0

Images

quay.io/coreos/flannel:v0.15.1
ghcr.io/talos-systems/install-cni:v0.7.0-1-gd6b73a7
docker.io/coredns/coredns:1.8.6
gcr.io/etcd-development/etcd:v3.5.1
k8s.gcr.io/kube-apiserver:v1.23.1
k8s.gcr.io/kube-controller-manager:v1.23.1
k8s.gcr.io/kube-scheduler:v1.23.1
k8s.gcr.io/kube-proxy:v1.23.1
ghcr.io/talos-systems/kubelet:v1.23.1
ghcr.io/talos-systems/installer:v0.14.0
k8s.gcr.io/pause:3.2