siderolabs/talos v1.10.0-alpha.1

on GitHub

Talos 1.10.0-alpha.1 (2025-01-31)

Welcome to the v1.10.0-alpha.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

auditd

Kernel parameter talos.auditd.disabled=1 can be used to disable Talos built-in auditd service.

cgroups v1

Talos Linux no longer supports cgroupsv1 when running in non-container mode.
The kernel argument talos.unified_cgroup_hierarchy is now ignored.

Driver Rebind

Talos 1.10 now supports a new machine config document named PCIDriverRebindConfig that allows rebinding the driver of a PCI device to a different target driver.
See the documentation for more information.

iSCSI Initiator

Talos now generates /etc/iscsi/initiatorname.iscsi file based on the node identity which is tied to the lifecycle of the node.
If using iscsi-tools extension, starting with Talos 1.10 would have a more deterministic IQN for the initiator node.
Make sure to update any iSCSI targets to use the new initiator IQN.

The iqn can be read by talosctl read /etc/iscsi/initiatorname.iscsi

ISO

Talos starting with 1.10 will have ISO's that will use GRUB only for legacy BIOS and systemd-boot for modern UEFI systems.

kube-apiserver Authorization Config

When using .cluster.apiServer.authorizationConfig the user provided order for the authorizers is honoured and Node and RBAC authorizers are always added to the end if not explicitly specified.

Eg: If user provides only Webhook authorizer, the final order will be Webhook, Node, RBAC.

To provide a specific order for Node or RBAC explicitly, user can provide the authorizer in the order they want.

Eg:

cluster:
  apiServer:
    authorizationConfig:
      - type: Node
        name: Node
      - type: Webhook
        name: Webhook
        webhook:
          connectionInfo:
            type: InClusterConfig
        ...
      - type: RBAC
        name: rbac

Usage of authorization-mode CLI argument will not support this form of customization.

NVMe NQN

Talos now generates /etc/nvme/hostnqn and /etc/nvme/hostid files based on the node identity which is tied to the lifecycle of the node.

The NQN can be read by talosctl read /etc/nvme/hostnqn

Component Updates

• Linux: 6.12.11
• CNI plugins: 1.6.2
• runc: 1.2.4
• containerd: 2.0.2
• etcd: 3.5.18

Talos is built with Go 1.23.5.

Contributors

• Andrey Smirnov
• Noel Georgi
• Dmitriy Matrenichev
• Dmitry Sharshakov
• Justin Garrison
• Nico Berlee
• Skyler Mäntysaari
• Utku Ozdemir
• Alexis La Goutte
• Andrew Symington
• Christian Luetke-Stetzkamp
• Christoph Hoopmann
• Devin Buhl
• Florian Grignon
• Ganawa Juanah
• Jason Benedicic
• K Birt
• KillianCdP
• L.J. Hanson
• Louis SCHNEIDER
• Marcel Hamer
• Motte
• Natalie Romana Albers
• PRIHLOP
• Ram
• Tim Olson
• Tine Jozelj
• TomyLobo
• bzub
• greenpsi
• sflotat2607
• suse-coder

Changes

Changes since v1.10.0-alpha.0

Changes from siderolabs/crypto

Changes from siderolabs/extras

Changes from siderolabs/gen

Changes from siderolabs/go-talos-support

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

• cloud.google.com/go/compute/metadata v0.5.2 -> v0.6.0
• github.com/aws/aws-sdk-go-v2/config v1.28.5 -> v1.28.7
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 -> v1.16.22
• github.com/aws/aws-sdk-go-v2/service/kms v1.37.6 -> v1.37.8
• github.com/containerd/cgroups/v3 v3.0.4 -> v3.0.5
• github.com/containerd/containerd/v2 v2.0.1 -> v2.0.2
• github.com/containerd/platforms v1.0.0-rc.0 -> v1.0.0-rc.1
• github.com/containernetworking/plugins v1.6.0 -> v1.6.1
• github.com/cosi-project/runtime v0.7.6 -> v0.8.1
• github.com/docker/cli v27.3.1 -> v27.4.1
• github.com/docker/docker v27.3.1 -> v27.4.1
• github.com/foxboron/go-uefi fab4fdf2f2f3 -> 19dc140271bf
• github.com/google/go-tpm v0.9.1 -> v0.9.3
• github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 -> v2.2.0
• github.com/hetznercloud/hcloud-go/v2 v2.17.0 -> v2.17.1
• github.com/opencontainers/runc v1.2.2 -> v1.2.4
• github.com/siderolabs/crypto v0.5.0 -> v0.5.1
• github.com/siderolabs/extras v1.9.0 -> v1.10.0-alpha.0-2-gf4a110f
• github.com/siderolabs/gen v0.7.0 -> v0.8.0
• github.com/siderolabs/go-blockdevice/v2 v2.0.7 -> v2.0.13
• github.com/siderolabs/go-talos-support v0.1.1 -> v0.1.2
• github.com/siderolabs/pkgs v1.9.0-12-g9576b97 -> v1.10.0-alpha.0-34-g5763e3e
• github.com/siderolabs/talos/pkg/machinery v1.9.0 -> v1.10.0-alpha.1
• github.com/siderolabs/tools v1.9.0-1-geaad82f -> v1.10.0-alpha.0-7-g7200845
• github.com/thejerf/suture/v4 v4.0.5 -> v4.0.6
• go.etcd.io/etcd/api/v3 v3.5.17 -> v3.5.18
• go.etcd.io/etcd/client/pkg/v3 v3.5.17 -> v3.5.18
• go.etcd.io/etcd/client/v3 v3.5.17 -> v3.5.18
• go.etcd.io/etcd/etcdutl/v3 v3.5.17 -> v3.5.18
• golang.org/x/net v0.32.0 -> v0.34.0
• golang.org/x/sys v0.28.0 -> v0.29.0
• golang.org/x/term v0.27.0 -> v0.28.0
• google.golang.org/grpc v1.68.1 -> v1.69.2
• google.golang.org/protobuf v1.35.2 -> v1.36.1
• k8s.io/api v0.32.0 -> v0.32.1
• k8s.io/apiserver v0.32.0 -> v0.32.1
• k8s.io/client-go v0.32.0 -> v0.32.1
• k8s.io/component-base v0.32.0 -> v0.32.1
• k8s.io/kube-scheduler v0.32.0 -> v0.32.1
• k8s.io/kubectl v0.32.0 -> v0.32.1
• k8s.io/kubelet v0.32.0 -> v0.32.1
• k8s.io/pod-security-admission v0.32.0 -> v0.32.1
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.72 -> v1.2.73

Previous release can be found at v1.9.0

Images

ghcr.io/siderolabs/flannel:v0.26.1
registry.k8s.io/coredns/coredns:v1.12.0
gcr.io/etcd-development/etcd:v3.5.18
registry.k8s.io/kube-apiserver:v1.32.1
registry.k8s.io/kube-controller-manager:v1.32.1
registry.k8s.io/kube-scheduler:v1.32.1
registry.k8s.io/kube-proxy:v1.32.1
ghcr.io/siderolabs/kubelet:v1.32.1
ghcr.io/siderolabs/installer:v1.10.0-alpha.1
registry.k8s.io/pause:3.10