Talos 1.14.3 (2026-10-15)
Welcome to the v1.14.3 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Time Check API
The TimeService/TimeCheck API (talosctl time --check) is no longer available to the os:reader role, as it allows querying
arbitrary time servers from the node. The TimeService/Time API (querying the configured time server) is still available to os:reader.
PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under /dev,
the name should start with ptp (e.g. /dev/ptp0, /dev/ptp_kvm), and the device should be a PTP character device.
Component Updates
Linux: 6.18.56
containerd: 2.3.7
etcd: 3.7.2
Talos is built with Go 1.26.9.
Contributors
- Andrey Smirnov
- Alexander Soelberg Heidarsson
- Angelos Petheriotis
- Brian Cappello
- Christoph Engelbert (noctarius)
- Mateusz Urbanek
- Noel Georgi
- Oguz Kilcan
- Steve Wills
- frauniki
Changes
17 commits
- 68da63f11 release(v1.14.3): prepare release
- cbe344931 fix: disable GSO offload on QEMU 10.2+
- 1e3f3ad5f test: adapt minimal settings to new QEMU version
- 59e1fcd63 fix: restrict raw disk helper to linux
- 08b213686 fix: make the imager installer reproducible with system extensions
- a9b984aab fix: improve KubePrism load balancer recovery
- d01538115 fix: clean up mountpoints on unmount
- 146c2bd92 fix: roll back stacked try configs to the config before the first try
- f5182237e fix: correct handling of DHCP changing address
- f97d79fc3 fix: image verification test
- 5fadce79d fix: verify the claim for the legacy bundle image verification
- 6cade9fed fix: restore source names for pseudo filesystem mounts
- 692e6796b fix: add validation for the PTP device name
- b166b72ca fix: network on azure (and might fix some other platforms)
- 4c4e57a4b feat: update etcd to 3.7.2
- 0d3b40c44 feat: update tools and pkgs
- 51d094f47 fix: tear down stale routes before adding their replacements
Changes from siderolabs/pkgs
5 commits
- siderolabs/pkgs@5fa47d1 feat: update to containerd 2.3.7
- siderolabs/pkgs@6873154 feat: update Linux to 6.18.56
- siderolabs/pkgs@ecd53d0 feat: enable pNFS block and SCSI layouts in nfsd
- siderolabs/pkgs@473b20c feat: enable bhyve guest support on amd64
- siderolabs/pkgs@f3add0c feat: enable Qualcomm Cloud AI 100 (QAIC) driver
Changes from siderolabs/tools
Dependency Changes
- github.com/containerd/containerd/v2 v2.3.6 -> v2.3.7
- github.com/siderolabs/pkgs v1.14.0-37-g6c312e4 -> v1.14.0-42-g5fa47d1
- github.com/siderolabs/talos/pkg/machinery v1.14.2 -> v1.14.3
- github.com/siderolabs/tools v1.14.0-8-g9776960 -> v1.14.0-9-g6b71647
- go.etcd.io/etcd/api/v3 v3.7.1 -> v3.7.2
- go.etcd.io/etcd/client/pkg/v3 v3.7.1 -> v3.7.2
- go.etcd.io/etcd/client/v3 v3.7.1 -> v3.7.2
- go.etcd.io/etcd/etcdutl/v3 v3.7.1 -> v3.7.2
- golang.org/x/net v0.58.0 -> v0.60.0
- golang.org/x/sync v0.22.0 -> v0.23.0
- golang.org/x/sys v0.47.0 -> v0.48.0
- golang.org/x/term v0.45.0 -> v0.46.0
- golang.org/x/text v0.41.0 -> v0.42.0
Previous release can be found at v1.14.2
Images
ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.7.2
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.1
registry.k8s.io/kube-controller-manager:v1.37.1
registry.k8s.io/kube-scheduler:v1.37.1
registry.k8s.io/kube-proxy:v1.37.1
ghcr.io/siderolabs/kubelet:v1.37.1
registry.k8s.io/networking/kube-network-policies:v1.1.2
ghcr.io/siderolabs/installer-base:v1.14.3
ghcr.io/siderolabs/imager:v1.14.3
ghcr.io/siderolabs/talos:v1.14.3
ghcr.io/siderolabs/talosctl-all:v1.14.3
ghcr.io/siderolabs/overlays:v1.14.3
ghcr.io/siderolabs/extensions:v1.14.3