siderolabs/talos v1.10.0

on GitHub

Talos 1.10.0 (2025-04-30)

Welcome to the v1.10.0 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

auditd

Kernel parameter talos.auditd.disabled=1 can be used to disable Talos built-in auditd service.

cgroups v1

Talos Linux no longer supports cgroupsv1 when running in non-container mode.
The kernel argument talos.unified_cgroup_hierarchy is now ignored.

Disk Image

Talos starting with 1.10 will have disk images that will use GRUB only for legacy BIOS and systemd-boot for modern UEFI systems.
On first boot Talos determines the boot method and will wipe the unused bootloader.

Secureboot disk-images will be sd-boot only.

For ARM64 imager will still generate GRUB bootloader for Talos < 1.10 and for Talos >= 1.10 all ARM64 boot assets will use systemd-boot.

Imager supports overwriting bootloader when generating a disk image via the Imager profile output option.

Eg:

output:
  kind: image
  imageOptions:
    bootloader: sd-boot # supported options are sd-boot, grub, dual-boot

Driver Rebind

Talos 1.10 now supports a new machine config document named PCIDriverRebindConfig that allows rebinding the driver of a PCI device to a different target driver.
See the documentation for more information.

Ethernet

Talos now provides ethtool-style Ethernet low-level configuration via network/EthernetConfig documents.
Current status of the interface can be read by talosctl get ethernetstatus.

Machine Install Extensions

.machine.install.extensions will have no effect starting from Talos 1.10, the machine config document field is still kept so upgrades from older versions are possible.
Use Boot Assets instead.

Extra Kernel Args

Talos 1.10 on fresh install on UEFI systems will now use systemd-boot and UKIs (Unified Kernel Images)[https://uapi-group.org/specifications/specs/unified_kernel_image/].
This means the kernel command line arguments are part of the UKI and cannot be modified without an upgrade to a new UKI.

Upgrades to Talos 1.10 will preseve the existing bootloader (GRUB for non-secureboot) and sd-boot for Secureboot and this change will have no effect.

To build a boot asset with extra kernel arguments whether an installer or a boot image use either Image Factory or
Imager.

This means kernel arguments not part of the UKI will not be preserved across updates and a proper installer image generated via Imager Factory or Imager is required.

Ingress Firewall

Talos Ingress Firewall now filters access to Kubernetes NodePort services correctly.

iSCSI Initiator

Talos now generates /etc/iscsi/initiatorname.iscsi file based on the node identity which is tied to the lifecycle of the node.
If using iscsi-tools extension, starting with Talos 1.10 would have a more deterministic IQN for the initiator node.
Make sure to update any iSCSI targets to use the new initiator IQN.

The iqn can be read by talosctl read /etc/iscsi/initiatorname.iscsi

ISO

Talos starting with 1.10 will have ISO's that will use GRUB only for legacy BIOS and systemd-boot for modern UEFI systems.

kube-apiserver Authorization Config

When using .cluster.apiServer.authorizationConfig the user provided order for the authorizers is honoured and Node and RBAC authorizers are always added to the end if not explicitly specified.

Eg: If user provides only Webhook authorizer, the final order will be Webhook, Node, RBAC.

To provide a specific order for Node or RBAC explicitly, user can provide the authorizer in the order they want.

Eg:

cluster:
  apiServer:
    authorizationConfig:
      - type: Node
        name: Node
      - type: Webhook
        name: Webhook
        webhook:
          connectionInfo:
            type: InClusterConfig
        ...
      - type: RBAC
        name: rbac

Usage of authorization-mode CLI argument will not support this form of customization.

NVMe NQN

Talos now generates /etc/nvme/hostnqn and /etc/nvme/hostid files based on the node identity which is tied to the lifecycle of the node.

The NQN can be read by talosctl read /etc/nvme/hostnqn

SELinux

Talos now supports enabling SELinux enforcing mode, see SELinux for more details.

Fully bootstrapped builds

Talos 1.10 is built with a toolchain based on [Stageˣ], which is a project building fully bootstrapped software.
This change increases reproducibility, auditability and security of Talos builds.

This also changes Talos root filesystem structure for unified /usr, with other directories symlinking to /usr/bin and /usr/lib.
System extensions must move their directories accordingly for 1.10.

Component Updates

• Linux: 6.12.25
• CNI plugins: 1.6.2
• runc: 1.2.6
• containerd: 2.0.5
• etcd: 3.5.20
• Flannel: 0.26.7
• Kubernetes: 1.33.0
• CoreDNS: 1.12.1

Talos is built with Go 1.24.2.

User Volumes

Talos now supports user disk volumes via the UserVolumeConfig machine config document.

The old .machine.disks field is deprecated, but still supported for backwards compatibility.

Contributors

• Andrey Smirnov
• Noel Georgi
• Dmitriy Matrenichev
• Dmitry Sharshakov
• Dmitrii Sharshakov
• Joakim Nohlgård
• Justin Garrison
• Orzelius
• 459below
• Andrew Longwill
• Enrique Hernández Bello
• Marat Bakeev
• Mathspy
• Nico Berlee
• Shiroki Satsuki
• Skyler Mäntysaari
• Utku Ozdemir
• ihelmer07
• Adam Cirillo
• Alex Lubbock
• Alexander James Candfield
• Alexis La Goutte
• Andrew Symington
• Artem Chernyshev
• Cazmill13
• Christian Luetke-Stetzkamp
• Christoph Hoopmann
• Dennis
• Devin Buhl
• Dominik Masur
• Ermeikin Sergei
• Florian Grignon
• Gabe Alford
• Ganawa Juanah
• George Gaál
• Jason Benedicic
• Joakim Nohlgård
• Josef
• K Birt
• KillianCdP
• L.J. Hanson
• Louis SCHNEIDER
• Marcel Hamer
• Mikhail Petrov
• Motte
• Natalie Romana Albers
• Nikolai Shields
• Omar
• PRIHLOP
• Ram
• Robin Elfrink
• Rouke Broersma
• Ryan Jacobs
• SayfEddine
• Serge Logvinov
• Shaderbug
• Stepan Rabotkin
• Steven I.
• Thomas Gosteli
• Tim Olson
• Tine Jozelj
• Tobias Kohlbau
• TomyLobo
• Valtteri Huuskonen
• bzub
• greenpsi
• jvanthienen
• jvanthienen-gluo
• mehlc
• pphysch
• sflotat2607
• suse-coder

Changes

Changes since v1.10.0-beta.1

Changes from siderolabs/crypto

Changes from siderolabs/discovery-api

Changes from siderolabs/discovery-client

Changes from siderolabs/gen

Changes from siderolabs/go-circular

Changes from siderolabs/go-debug

Changes from siderolabs/go-kubeconfig

Changes from siderolabs/go-kubernetes

Changes from siderolabs/go-loadbalancer

Changes from siderolabs/go-pcidb

Changes from siderolabs/go-pointer

Changes from siderolabs/go-talos-support

Changes from siderolabs/pkgs

Changes from siderolabs/proto-codec

Changes from siderolabs/siderolink

Changes from siderolabs/tools

Dependency Changes

• cloud.google.com/go/compute/metadata v0.5.2 -> v0.6.0
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 -> v1.18.0
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 -> v1.9.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.3.0 -> v1.3.1
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.0 -> v1.3.1
• github.com/aws/aws-sdk-go-v2/config v1.28.5 -> v1.29.14
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 -> v1.16.30
• github.com/aws/aws-sdk-go-v2/service/kms v1.37.6 -> v1.38.3
• github.com/aws/smithy-go v1.22.1 -> v1.22.3
• github.com/containerd/cgroups/v3 v3.0.4 -> v3.0.5
• github.com/containerd/containerd/v2 v2.0.1 -> v2.0.5
• github.com/containerd/platforms v1.0.0-rc.0 -> v1.0.0-rc.1
• github.com/containernetworking/cni v1.2.3 -> v1.3.0
• github.com/containernetworking/plugins v1.6.0 -> v1.6.2
• github.com/cosi-project/runtime v0.7.6 -> v0.10.2
• github.com/docker/cli v27.3.1 -> v28.0.4
• github.com/docker/docker v27.3.1 -> v28.0.4
• github.com/elastic/go-libaudit/v2 v2.6.1 -> v2.6.2
• github.com/florianl/go-tc v0.4.4 -> v0.4.5
• github.com/foxboron/go-uefi fab4fdf2f2f3 -> 69fb7dba244f
• github.com/fsnotify/fsnotify v1.8.0 -> v1.9.0
• github.com/gdamore/tcell/v2 v2.7.4 -> v2.8.1
• github.com/google/cadvisor v0.51.0 -> v0.52.1
• github.com/google/cel-go v0.22.1 -> v0.24.1
• github.com/google/go-containerregistry v0.20.2 -> v0.20.3
• github.com/google/go-tpm v0.9.1 -> v0.9.3
• github.com/google/nftables v0.2.0 -> v0.3.0
• github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 -> v2.3.1
• github.com/hetznercloud/hcloud-go/v2 v2.17.0 -> v2.21.0
• github.com/insomniacslk/dhcp a3a4c1f04475 -> 8abf58130905
• github.com/jsimonetti/rtnetlink/v2 2d6e9f8ad3f2 -> v2.0.3
• github.com/klauspost/compress v1.17.11 -> v1.18.0
• github.com/klauspost/cpuid/v2 v2.2.9 -> v2.2.10
• github.com/mdlayher/ethtool v0.2.0 -> v0.4.0
• github.com/mdlayher/netlink v1.7.2 -> fbb4dce95f42
• github.com/mdp/qrterminal/v3 v3.2.0 -> v3.2.1
• github.com/miekg/dns v1.1.62 -> v1.1.65
• github.com/opencontainers/image-spec v1.1.0 -> v1.1.1
• github.com/opencontainers/runtime-spec v1.2.0 -> v1.2.1
• github.com/pelletier/go-toml/v2 v2.2.3 -> v2.2.4
• github.com/prometheus/procfs v0.15.1 -> v0.16.0
• github.com/rivo/tview c76f7879f592 -> 949945f8d922
• github.com/safchain/ethtool v0.5.9 -> v0.5.10
• github.com/scaleway/scaleway-sdk-go v1.0.0-beta.30 -> v1.0.0-beta.33
• github.com/siderolabs/crypto v0.5.0 -> v0.5.1
• github.com/siderolabs/discovery-api v0.1.5 -> v0.1.6
• github.com/siderolabs/discovery-client v0.1.10 -> v0.1.11
• github.com/siderolabs/gen v0.7.0 -> v0.8.0
• github.com/siderolabs/go-blockdevice/v2 v2.0.7 -> v2.0.16
• github.com/siderolabs/go-circular v0.2.1 -> v0.2.2
• github.com/siderolabs/go-debug v0.4.0 -> v0.5.0
• github.com/siderolabs/go-kubeconfig v0.1.0 -> v0.1.1
• github.com/siderolabs/go-kubernetes v0.2.17 -> v0.2.21
• github.com/siderolabs/go-loadbalancer v0.3.4 -> v0.4.0
• github.com/siderolabs/go-pcidb v0.3.0 -> v0.3.1
• github.com/siderolabs/go-pointer v1.0.0 -> v1.0.1
• github.com/siderolabs/go-talos-support v0.1.1 -> v0.1.2
• github.com/siderolabs/pkgs v1.9.0-12-g9576b97 -> v1.10.0-5-g48dba3e
• github.com/siderolabs/proto-codec v0.1.1 -> v0.1.2
• github.com/siderolabs/siderolink v0.3.11 -> v0.3.13
• github.com/siderolabs/talos/pkg/machinery v1.9.0 -> v1.10.0
• github.com/siderolabs/tools v1.9.0-1-geaad82f -> v1.10.0
• github.com/spf13/cobra v1.8.1 -> v1.9.1
• github.com/spf13/pflag v1.0.5 -> v1.0.6
• github.com/thejerf/suture/v4 v4.0.5 -> v4.0.6
• go.etcd.io/etcd/api/v3 v3.5.17 -> v3.5.21
• go.etcd.io/etcd/client/pkg/v3 v3.5.17 -> v3.5.21
• go.etcd.io/etcd/client/v3 v3.5.17 -> v3.5.21
• go.etcd.io/etcd/etcdutl/v3 v3.5.17 -> v3.5.21
• go.uber.org/goleak v1.3.0 new
• golang.org/x/net v0.32.0 -> v0.39.0
• golang.org/x/oauth2 v0.24.0 -> v0.29.0
• golang.org/x/sync v0.10.0 -> v0.13.0
• golang.org/x/sys v0.28.0 -> v0.32.0
• golang.org/x/term v0.27.0 -> v0.31.0
• golang.org/x/text v0.21.0 -> v0.24.0
• golang.org/x/time v0.8.0 -> v0.11.0
• golang.zx2c4.com/wireguard/wgctrl 925a1e7659e6 -> a9ab2273dd10
• google.golang.org/grpc v1.68.1 -> v1.71.1
• google.golang.org/protobuf v1.35.2 -> v1.36.6
• k8s.io/api v0.32.0 -> v0.33.0
• k8s.io/apimachinery v0.32.0 -> v0.33.0
• k8s.io/apiserver v0.32.0 -> v0.33.0
• k8s.io/client-go v0.32.0 -> v0.33.0
• k8s.io/component-base v0.32.0 -> v0.33.0
• k8s.io/cri-api v0.32.0 -> v0.33.0
• k8s.io/kube-scheduler v0.32.0 -> v0.33.0
• k8s.io/kubectl v0.32.0 -> v0.33.0
• k8s.io/kubelet v0.32.0 -> v0.33.0
• k8s.io/pod-security-admission v0.32.0 -> v0.33.0
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.72 -> v1.2.76

Previous release can be found at v1.9.0

Images

ghcr.io/siderolabs/flannel:v0.26.7
registry.k8s.io/coredns/coredns:v1.12.1
gcr.io/etcd-development/etcd:v3.5.21
registry.k8s.io/kube-apiserver:v1.33.0
registry.k8s.io/kube-controller-manager:v1.33.0
registry.k8s.io/kube-scheduler:v1.33.0
registry.k8s.io/kube-proxy:v1.33.0
ghcr.io/siderolabs/kubelet:v1.33.0
ghcr.io/siderolabs/installer:v1.10.0
registry.k8s.io/pause:3.10