siderolabs/talos v1.0.0

on GitHub

Talos 1.0.0 (2022-03-29)

Welcome to the v1.0.0 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

GitHub Organization Change

Talos Linux and other repositories were migrated from the talos-systems GitHub organization
to the siderolabs organization (github.com/talos-systems -> github.com/siderolabs).

Existing Talos Linux container images (installer, talos, etc.) are mirrored across both organizations,
but please use the new organization name going forward.

For example, when upgrading Talos use ghcr.io/siderolabs instead of ghcr.io/talos-systems:

talosctl upgrade --image ghcr.io/siderolabs/installer:v1.0.0

Admission Plugin Configuration

Talos now supports Kubernetes API server admission plugin configuration via the .cluster.apiServer.admissionControl machine configuration field.

This configuration can be used to enable Pod Security Admission plugin and
define cluster-wide default Pod Security Standards.

Apply Config Enhancements

talosctl apply/patch/edit cli commands got revamped.
Separate flags --on-reboot, --immediate, --interactive were replaced
with a single --mode flag that can take the following values:

• auto new mode that automatically applies the configuration in immediate/reboot mode.
• no-reboot force apply immediately, if not possible, then fail.
• reboot force reboot with apply config.
• staged write new machine configuration to STATE, but don't apply it (it will be applied after a reboot).
• interactive starts interactive installer, only for apply.

API Server Audit Logs

kube-apiserver is now configured to store its audit logs separately from the kube-apiserver standard logs and directly to file.
The kube-apiserver will maintain the rotation and retirement of these logs, which are stored in /var/log/audit/.
Previously, the audit logs were sent to kube-apiserver's stdout, along with the rest of its logs, to be collected in the usual manner by Kubernetes.

Equinix Metal Platform

talos.platform for Equinix Metal is renamed from packet to equinixMetal, the older name is still supported for backwards compatibility.

Extension Services

Talos now provides a way to extend set of system services Talos runs with extension services.
Extension services should be included in the Talos root filesystem (e.g. via system extensions).

NVIDIA GPU alpha support

Talos now has alpha support for NVIDIA GPU based workloads.
Check the NVIDA GPU support guide at https://www.talos.dev/v1.0/guides/nvidia-gpu/

Pinned Kubernetes Version

Command talosctl gen config now defaults to Kubernetes version pinning in the generate machine configuration.
Previously default was to omit explicit Kubernetes version, so Talos picked up the default version it was built against.
Old behavior can be achieved by specifying empty flag value: --kubernetes-version=.

Kernel Parameters

Talos now supports setting bond interface from Kernel cmdline using the bond= option.
Reference: https://man7.org/linux/man-pages/man7/dracut.cmdline.7.html

Kubelet

Kubelet configuration can now be overridden with the .machine.kubelet.extraConfig machine configuration field.
As most of the kubelet command line arguments are being deprecated, it is recommended to migrate to extraConfig
instead of using extraArgs.

A number of conformance tweaks have been made to the kubelet to allow it to run without
protectKernelDefaults.
This includes both kubelet configuration options and sysctls.
Of particular note is that Talos now sets the kernel.panic reboot interval to 10s instead of 1s.
If your kubelet fails to start after the upgrade, please check the kubelet logs to determine the problem.

Talos now performs graceful kubelet shutdown by default on node reboot/shutdown.
Default shutdown timeouts: 20s for regular priority pods and 10s for critical priority pods.
Timeouts can be overridden with the .machine.kubelet.extraConfig machine configuration key:
shutdownGracePeriod and shutdownGracePeriodCriticalPods.

Machine Configuration

Talos now preserves machine configuration as it was submitted to the node.

Machine Configuration Patching

talosctl commands which accept JSON patches (gen config, cluster create, patch machineconfig) now support multiple patches, loading patches
from files with @file.json syntax, and support loading from YAML format.

Platform Support

Talos now supports Oracle Cloud.

Platform network configuration was rewritten to avoid modifying Talos machine configuration.
Network configuration is performed independent of the machine configuration presence, so it works
even if Talos is booted in maintenance mode (without machine configuration is platform userdata).

Pod Security Policy

Pod Security Policy Kubernetes feature is deprecated and is going to be removed in Kubernetes 1.25.
Talos by default skips setting up PSP now (see machine configuration .cluster.apiServer.disablePodSecurityPolicy).

SBC Support

Talos now supports Jetson Nano SBC.

Static Pods in the Machine Configuration

Talos now accepts static pod definitions in the .machine.pods key of the machine configuration.
Please note that static pod definitions are not validated by Talos.
Static pod definitions can be updated without a node reboot.

Sysfs Kernel Parameters

Talos now supports setting sysfs kernel parameters (/sys/...).
Use machine configuration field .machine.sysfs to set sysfs kernel parameters.

System Extensions

System extensions allow extending Talos root filesystem, which enables a set of different features, including custom
container runtimes, additional firmware, etc.

System extensions are only activated during Talos installation (or upgrade), and with system extensions installed, Talos
root filesystem is still immutable and read-only.

Please see extensions repository and documentation for more information.

Component Updates

• Linux: 5.15.32
• Kubernetes: 1.23.5
• CoreDNS: 1.9.1
• etcd: 3.5.2
• containerd: 1.6.2
• runc: 1.1.0

Talos is built with Go 1.17.8

Wipe System Kernel Parameter

Added new kernel parameter talos.experimental.wipe=system which can help resetting system disk for the machine
and start over with a fresh installation.
See Resetting a Machine on how to use it.

Contributors

• Andrey Smirnov
• Noel Georgi
• Serge Logvinov
• Seán C McCord
• Artem Chernyshev
• Spencer Smith
• Steve Francis
• Florian Klink
• Andrey Smirnov
• Andrew Rynhard
• Anthony Rabbito
• Bernard Sébastien
• Charlie Haley
• Eric Wohltman
• Jori Huisman
• Matt Layher
• Niklas Metje
• Philipp Sauter
• Shahar Naveh
• Tim Jones
• Utku Ozdemir
• nebulait

Changes

Changes since v1.0.0-beta.3

Changes from siderolabs/extras

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Changes from talos-systems/crypto

Changes from talos-systems/go-blockdevice

Changes from talos-systems/grpc-proxy

Changes from talos-systems/net

Dependency Changes

• cloud.google.com/go/compute v1.5.0 new
• github.com/BurntSushi/toml v0.4.1 -> v1.0.0
• github.com/aws/aws-sdk-go v1.43.8 new
• github.com/containerd/cgroups v1.0.2 -> 2e502f6b9e43
• github.com/containerd/containerd v1.5.8 -> v1.6.2
• github.com/containernetworking/plugins v1.0.1 -> v1.1.0
• github.com/docker/distribution v2.7.1 -> v2.8.0
• github.com/docker/docker v20.10.11 -> v20.10.12
• github.com/godbus/dbus/v5 v5.0.6 new
• github.com/google/go-cmp v0.5.6 -> v0.5.7
• github.com/google/nftables 16a134723a96 -> 211824995dcb
• github.com/hashicorp/go-cleanhttp v0.5.2 new
• github.com/hashicorp/go-getter v1.5.9 -> v1.5.11
• github.com/hashicorp/go-version v1.4.0 new
• github.com/insomniacslk/dhcp 5297eed8f489 -> 3c283ff8b7dd
• github.com/jsimonetti/rtnetlink fd9a11f42291 -> v1.1.0
• github.com/jxskiss/base62 v1.0.0 -> v1.1.0
• github.com/mdlayher/arp f72070a231fc -> c37aaafac7f9
• github.com/mdlayher/ethtool 288d040e9d60 -> 856bd6cb8a38
• github.com/mdlayher/genetlink v1.0.0 -> v1.2.0
• github.com/mdlayher/netlink v1.4.2 -> v1.6.0
• github.com/opencontainers/image-spec v1.0.2 new
• github.com/packethost/packngo v0.20.0 -> v0.22.0
• github.com/pelletier/go-toml v1.9.4 new
• github.com/pmorjan/kmod v1.0.0 new
• github.com/rivo/tview 2a6de950f73b -> 96063d6082f3
• github.com/scaleway/scaleway-sdk-go v1.0.0-beta.7 -> v1.0.0-beta.9
• github.com/siderolabs/extras v0.7.0-1-gd6b73a7 -> v1.0.0
• github.com/siderolabs/pkgs v0.9.0-1-g7a3419a -> v1.0.0-6-g7c293d5
• github.com/siderolabs/tools v0.9.0-1-gb1146f9 -> v1.0.0-1-g4c77d96
• github.com/spf13/cobra v1.2.1 -> v1.3.0
• github.com/talos-systems/crypto v0.3.4 -> v0.3.5
• github.com/talos-systems/go-blockdevice v0.2.5 -> v0.3.1
• github.com/talos-systems/grpc-proxy v0.2.0 -> v0.3.0
• github.com/talos-systems/net v0.3.1 -> v0.3.2
• github.com/u-root/u-root v7.0.0 -> v0.8.0
• github.com/vishvananda/netlink f5de75959ad5 -> 650dca95af54
• github.com/vmware-tanzu/sonobuoy v0.55.1 -> v0.56.2
• github.com/vmware/govmomi v0.27.2 -> v0.27.4
• go.etcd.io/etcd/api/v3 v3.5.1 -> v3.5.2
• go.etcd.io/etcd/client/pkg/v3 v3.5.1 -> v3.5.2
• go.etcd.io/etcd/client/v3 v3.5.1 -> v3.5.2
• go.etcd.io/etcd/etcdutl/v3 v3.5.1 -> v3.5.2
• go.uber.org/zap v1.19.1 -> v1.21.0
• golang.org/x/net 491a49abca63 -> 27dd8689420f
• golang.org/x/sys 97ca703d548d -> 4e6760a101f9
• golang.org/x/time f0f3c7e86c11 -> 0e9765cccd65
• golang.zx2c4.com/wireguard/wgctrl dd7407c86d22 -> fde48d68ee68
• google.golang.org/grpc v1.42.0 -> v1.44.0
• k8s.io/api v0.23.1 -> v0.23.5
• k8s.io/apimachinery v0.23.1 -> v0.23.5
• k8s.io/apiserver v0.23.5 new
• k8s.io/client-go v0.23.1 -> v0.23.5
• k8s.io/component-base v0.23.1 -> v0.23.5
• k8s.io/cri-api v0.23.1 -> v0.23.5
• k8s.io/kubectl v0.23.1 -> v0.23.5
• k8s.io/kubelet v0.23.1 -> v0.23.5
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.61 -> v1.2.63

Previous release can be found at v0.14.0

Images

quay.io/coreos/flannel:v0.15.1
ghcr.io/siderolabs/install-cni:v1.0.0
docker.io/coredns/coredns:1.9.1
gcr.io/etcd-development/etcd:v3.5.2
k8s.gcr.io/kube-apiserver:v1.23.5
k8s.gcr.io/kube-controller-manager:v1.23.5
k8s.gcr.io/kube-scheduler:v1.23.5
k8s.gcr.io/kube-proxy:v1.23.5
ghcr.io/siderolabs/kubelet:v1.23.5
ghcr.io/siderolabs/installer:v1.0.0
k8s.gcr.io/pause:3.2