siderolabs/talos v1.1.0

on GitHub

Talos 1.1.0 (2022-06-22)

Welcome to the v1.1.0 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Kubernetes API Server Anonymous Auth

Anonymous authentication is now disabled by default for the kube-apiserver (CIS compliance).

To enable anonymous authentication, update the machine config with:

cluster:
    apiServer:
        extraArgs:
            anonymous-auth: true

Apply Config --dry-run

The commands talosctl apply-config, talosctl patch mc and talosctl edit mc now support --dry-run flag.
If enabled it just prints out the selected config application mode and the configuration diff.

Apply Config --mode=try

The commands talosctl apply-config, talosctl patch mc and talosctl edit mc now support the new mode called try.
In this mode the config change is applied for a period of time and then reverted back to the state it was before the change.
--timeout parameter can be used to customize the config rollback timeout.
This new mode can be used only with the parts of the config that can be changed without a reboot and can help to check that
the new configuration doesn't break the node.
Can be especially useful to check network interfaces changes that may lead to the loss of connectivity to the node.

IPv6 in Docker-based Talos Clusters

The command talosctl cluster create now enables IPv6 by default for the Docker containers
created for Talos nodes. This allows to use IPv6 addresses in Kubernetes networking.

If talosctl cluster create fails to work on Linux due to the lack of IPv6 support,
please use the flag --disable-docker-ipv6 to revert the change.

drop some default rules shipped by eudev

Drops some default eudev rules that doesn't make sense in the context of Talos OS.
Especially the ones around sound devices, cd-roms and renaming the network interfaces to be predictable

Network Device Selector

Talos machine configuration supports specifying network interfaces by selectors instead of interface name.
See documentation for more details.

Pod Security Admission

Pod Security Admission controller is enabled by default with the following policy:

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
- configuration:
    apiVersion: pod-security.admission.config.k8s.io/v1alpha1
    defaults:
      audit: restricted
      audit-version: latest
      enforce: baseline
      enforce-version: latest
      warn: restricted
      warn-version: latest
    exemptions:
      namespaces:
      - kube-system
      runtimeClasses: []
      usernames: []
    kind: PodSecurityConfiguration
  name: PodSecurity
  path: ""

The policy is part of the Talos machine configuration, and it can be modified to suite your needs.

Support RockPi 4 variants A and B

Talos now supports RockPi variants A and B in addition to RockPi 4C

Raspberry Pi PoE hat fan

Talos now enables the Raspberry Pi PoE fan control by pulling in the poe overlay that works with upstream kernel

Component Updates

• Linux: 5.15.48
• Containerd: v1.6.6
• Kubernetes: 1.24.2
• Flannel: 0.18.1
• runc: 1.1.2
• CoreDNS: v1.9.3

Talos is built with Go 1.18.3

x86-64 Architecture

Talos is built for x86-64 architecture with support for x86-64-v2 microarchitecture level,
so Talos no longer runs on processors supporting only baseline x86-64 microarchitecture (before 2009).

Contributors

• Andrey Smirnov
• Noel Georgi
• Tim Jones
• Dmitriy Matrenichev
• Spencer Smith
• Artem Chernyshev
• Serge Logvinov
• Philipp Sauter
• Andrew Rynhard
• Steve Francis
• Steve Francis
• Andrei Dobre
• Bastiaan Schaap
• Bᴇʀɴᴅ Sᴄʜᴏʀɢᴇʀs
• Caleb Woodbine
• Daniel Höxtermann
• Gerard de Leeuw
• Han Cen
• Jori Huisman
• Jorik Jonker
• Nat Allan
• Nico Berlee
• Philipp Sauter
• Rio Kierkels
• Sebastian Hasler
• Seán C McCord
• Suraj Shirvankar
• Tames McTigue
• Tim Jones
• Tomasz Zurkowski
• William Ashton

Changes

Changes since v1.1.0-beta.2

Changes from siderolabs/extras

Changes from siderolabs/go-pcidb

Changes from siderolabs/go-pointer

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Changes from talos-systems/go-blockdevice

Changes from talos-systems/go-loadbalancer

Changes from talos-systems/go-smbios

Changes from talos-systems/siderolink

Dependency Changes

• cloud.google.com/go/compute v1.5.0 -> v1.6.1
• github.com/BurntSushi/toml v1.0.0 -> v1.1.0
• github.com/aws/aws-sdk-go v1.43.8 -> v1.44.24
• github.com/containerd/cgroups 2e502f6b9e43 -> v1.0.4
• github.com/containerd/containerd v1.6.2 -> v1.6.4
• github.com/containernetworking/cni v1.0.1 -> v1.1.0
• github.com/containernetworking/plugins v1.1.0 -> v1.1.1
• github.com/cosi-project/runtime 264f8fcd1a4f -> 95d06feaf8b5
• github.com/docker/distribution v2.8.0 -> v2.8.1
• github.com/docker/docker v20.10.12 -> v20.10.16
• github.com/fsnotify/fsnotify v1.5.1 -> v1.5.4
• github.com/gdamore/tcell/v2 f057f0a857a1 -> v2.5.1
• github.com/golang/mock v1.6.0 new
• github.com/google/go-cmp v0.5.7 -> v0.5.8
• github.com/google/nftables 211824995dcb -> a9775fb167d2
• github.com/hashicorp/go-getter v1.5.11 -> v1.6.1
• github.com/hashicorp/go-version v1.4.0 -> v1.5.0
• github.com/hetznercloud/hcloud-go v1.33.1 -> v1.33.2
• github.com/insomniacslk/dhcp 3c283ff8b7dd -> 1ca156eafb9f
• github.com/jsimonetti/rtnetlink v1.1.0 -> v1.2.0
• github.com/mdlayher/arp c37aaafac7f9 -> 6706a2966875
• github.com/mdlayher/netx 669a06fde734 -> c711c2f8512f
• github.com/opencontainers/image-spec v1.0.2 -> c5a74bcca799
• github.com/packethost/packngo v0.22.0 -> v0.24.0
• github.com/pelletier/go-toml v1.9.4 -> v1.9.5
• github.com/rivo/tview 96063d6082f3 -> 9994674d60a8
• github.com/rs/xid v1.3.0 -> v1.4.0
• github.com/ryanuber/go-glob v1.0.0 new
• github.com/safchain/ethtool v0.2.0 new
• github.com/siderolabs/extras v1.0.0 -> v1.1.0-1-g5800284
• github.com/siderolabs/go-pcidb v0.1.0 new
• github.com/siderolabs/go-pointer v1.0.0 new
• github.com/siderolabs/pkgs v1.0.0-6-g7c293d5 -> v1.1.0-8-gfa9a488
• github.com/siderolabs/tools v1.0.0-1-g4c77d96 -> v1.1.0-1-g134974c
• github.com/spf13/cobra v1.3.0 -> v1.4.0
• github.com/spf13/pflag v1.0.5 new
• github.com/stretchr/testify v1.7.0 -> v1.7.1
• github.com/talos-systems/go-blockdevice v0.3.1 -> v0.3.2
• github.com/talos-systems/go-loadbalancer v0.1.1 -> v0.1.2
• github.com/talos-systems/go-smbios v0.1.1 -> v0.2.0
• github.com/talos-systems/siderolink v0.1.0 -> v0.1.2
• github.com/vishvananda/netlink 650dca95af54 -> v1.2.0-beta
• github.com/vmware-tanzu/sonobuoy v0.56.2 -> v0.56.6
• github.com/vmware/govmomi v0.27.4 -> v0.28.0
• github.com/vmware/vmw-guestinfo cc1fd90d572c -> 510905f0efa3
• github.com/vultr/metadata v1.0.3 -> v1.1.0
• go.etcd.io/etcd/api/v3 v3.5.2 -> v3.5.4
• go.etcd.io/etcd/client/pkg/v3 v3.5.2 -> v3.5.4
• go.etcd.io/etcd/client/v3 v3.5.2 -> v3.5.4
• go.etcd.io/etcd/etcdutl/v3 v3.5.2 -> v3.5.4
• golang.org/x/net 27dd8689420f -> 5463443f8c37
• golang.org/x/sync 036812b2e83c -> 0976fa681c29
• golang.org/x/sys 4e6760a101f9 -> bc2c85ada10a
• golang.org/x/term 03fcf44c2211 -> 065cf7ba2467
• golang.org/x/time 0e9765cccd65 -> 583f2d630306
• golang.zx2c4.com/wireguard/wgctrl fde48d68ee68 -> 3d4a969bb56b
• google.golang.org/grpc v1.44.0 -> v1.46.2
• google.golang.org/protobuf v1.27.1 -> v1.28.0
• k8s.io/api v0.23.5 -> v0.24.2
• k8s.io/apimachinery v0.23.5 -> v0.24.2
• k8s.io/apiserver v0.23.5 -> v0.24.2
• k8s.io/client-go v0.23.5 -> v0.24.2
• k8s.io/component-base v0.23.5 -> v0.24.2
• k8s.io/cri-api v0.23.5 -> v0.24.2
• k8s.io/klog/v2 v2.60.1 new
• k8s.io/kubectl v0.23.5 -> v0.24.2
• k8s.io/kubelet v0.23.5 -> v0.24.2
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.63 -> v1.2.64

Previous release can be found at v1.0.0

Images

ghcr.io/siderolabs/flannel:v0.18.1
ghcr.io/siderolabs/install-cni:v1.1.0-1-g5800284
docker.io/coredns/coredns:1.9.3
gcr.io/etcd-development/etcd:v3.5.4
k8s.gcr.io/kube-apiserver:v1.24.2
k8s.gcr.io/kube-controller-manager:v1.24.2
k8s.gcr.io/kube-scheduler:v1.24.2
k8s.gcr.io/kube-proxy:v1.24.2
ghcr.io/siderolabs/kubelet:v1.24.2
ghcr.io/siderolabs/installer:v1.1.0
k8s.gcr.io/pause:3.6