Talos 1.14.5 (2026-10-26)
Welcome to the v1.14.5 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
On-demand Kernel Module Loading
The kernel can once again ask Talos to load a module on demand (request_module()), e.g. when a driver loads a helper module while probing a device,
or when DRBD loads its transport module.
Talos handles the kernel's modprobe usermode helper call and loads the module (shipped with Talos or a system extension) by the requested name,
applying the parameters from KernelModuleConfig if the module is listed in the machine config.
Such modules no longer need to be listed in the machine config, and the order of the listed modules is not important.
Requests via subsystem aliases (e.g. fs-*, net-pf-*, crypto-*), which userspace can trigger via mounts, sockets, etc., are refused,
so on-demand loading can't be used to load arbitrary modules from workloads.
The outcome of each request is logged to the kernel log (talosctl dmesg).
Component Updates
Linux: 6.18.58
etcd: 3.7.3
Talos is built with Go 1.26.10.
Contributors
- Andrey Smirnov
- Mateusz Urbanek
- immanuwell
- Daniel Chaplin
- Erwan Leboucher
- Kyle Tse
- Michał Małyska
- Nicolas Brainez
- Orzelius
- sasha-sup
Changes
25 commits
- dad8d3edf release(v1.14.5): prepare release
- 2f97b6a4b test: verify on-demand kernel module loading end-to-end
- c35fd8cef feat: load kernel modules on demand via the modprobe usermode helper
- bf34a0ebb feat: add EDAC_10NM kernel module
- 25c16761c fix: race with platform accessing metadata volumes
- b88cda936 feat: update etcd to 3.7.3
- 34d408094 fix: pull images over HTTP/1.1
- 2dc3686b1 fix: preserve project quotas on temporary growfs mounts
- bffcf9b48 fix: correctly pass hostname to the proxy in gRPC dial
- 6b3ea905b fix: preserve rejected edits in talosctl edit
- b6e5fa2e2 feat: implement RAID1 (md-raid) support in BIOS mode
- fb2b077b5 fix: ignore netlink recoverable errors in watchers
- 2f7efe81b fix: skip kexec when the kernel finds no free memory region
- d6488456b fix: provide proper concurrency for health checks
- 03075319b fix: preserve omitted CEL expressions when patching configs
- aca5abc16 fix: skip EFI boot entries that cannot be decoded
- 9c69456c9 fix: read VMware guestinfo with SecureBoot enabled
- 6c6fec7d5 fix: parse EFI load options with an empty description
- e0002327b fix: route pod CIDRs matching the KubeSpan ULA purpose byte
- 449f82d46 fix: wait for inactive MD arrays before volume discovery
- 824b0f976 test: reproduce degraded md boot array reboot
- ce2fa4132 fix: high cpu usage by the bridge keepalive dummy qemu vm
- 51eda9a51 chore: add qemu-ip-family integration suite
- e700de0c0 feat: update Linux 6.18.58, Go 1.26.10
- 3fb46c378 release(v1.14.4): prepare release
Changes since v1.14.4
24 commits
- dad8d3edf release(v1.14.5): prepare release
- 2f97b6a4b test: verify on-demand kernel module loading end-to-end
- c35fd8cef feat: load kernel modules on demand via the modprobe usermode helper
- bf34a0ebb feat: add EDAC_10NM kernel module
- 25c16761c fix: race with platform accessing metadata volumes
- b88cda936 feat: update etcd to 3.7.3
- 34d408094 fix: pull images over HTTP/1.1
- 2dc3686b1 fix: preserve project quotas on temporary growfs mounts
- bffcf9b48 fix: correctly pass hostname to the proxy in gRPC dial
- 6b3ea905b fix: preserve rejected edits in talosctl edit
- b6e5fa2e2 feat: implement RAID1 (md-raid) support in BIOS mode
- fb2b077b5 fix: ignore netlink recoverable errors in watchers
- 2f7efe81b fix: skip kexec when the kernel finds no free memory region
- d6488456b fix: provide proper concurrency for health checks
- 03075319b fix: preserve omitted CEL expressions when patching configs
- aca5abc16 fix: skip EFI boot entries that cannot be decoded
- 9c69456c9 fix: read VMware guestinfo with SecureBoot enabled
- 6c6fec7d5 fix: parse EFI load options with an empty description
- e0002327b fix: route pod CIDRs matching the KubeSpan ULA purpose byte
- 449f82d46 fix: wait for inactive MD arrays before volume discovery
- 824b0f976 test: reproduce degraded md boot array reboot
- ce2fa4132 fix: high cpu usage by the bridge keepalive dummy qemu vm
- 51eda9a51 chore: add qemu-ip-family integration suite
- e700de0c0 feat: update Linux 6.18.58, Go 1.26.10
Changes from siderolabs/pkgs
6 commits
- siderolabs/pkgs@f4bda77 feat: update Linux to 6.18.58
- siderolabs/pkgs@a068a03 feat: enable EDAC_10NM kernel option
- siderolabs/pkgs@ec11950 fix: restore ACPI power button
- siderolabs/pkgs@42b6fe2 feat: update tools/toolchain
- siderolabs/pkgs@2ec10eb chore: update DRBD compat
- siderolabs/pkgs@643b731 feat: update Linux to 6.18.57
Changes from siderolabs/tools
2 commits
- siderolabs/tools@8dad45e feat: update ca-certificates to 2026-10-20
- siderolabs/tools@c6b3f5c chore: update the toolchain
Dependency Changes
- github.com/siderolabs/pkgs v1.14.0-42-g5fa47d1 -> v1.14.0-48-gf4bda77
- github.com/siderolabs/talos/pkg/machinery v1.14.3 -> v1.14.5
- github.com/siderolabs/tools v1.14.0-9-g6b71647 -> v1.14.0-11-g8dad45e
- go.etcd.io/etcd/api/v3 v3.7.2 -> v3.7.3
- go.etcd.io/etcd/client/pkg/v3 v3.7.2 -> v3.7.3
- go.etcd.io/etcd/client/v3 v3.7.2 -> v3.7.3
- go.etcd.io/etcd/etcdutl/v3 v3.7.2 -> v3.7.3
- golang.org/x/net v0.60.0 -> v0.61.0
- golang.org/x/sync v0.23.0 -> v0.24.0
- golang.org/x/sys v0.48.0 -> v0.49.0
- golang.org/x/term v0.46.0 -> v0.47.0
- golang.org/x/text v0.42.0 -> v0.43.0
Previous release can be found at v1.14.3
Images
ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.7.3
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.1
registry.k8s.io/kube-controller-manager:v1.37.1
registry.k8s.io/kube-scheduler:v1.37.1
registry.k8s.io/kube-proxy:v1.37.1
ghcr.io/siderolabs/kubelet:v1.37.1
registry.k8s.io/networking/kube-network-policies:v1.1.2
ghcr.io/siderolabs/installer-base:v1.14.5
ghcr.io/siderolabs/imager:v1.14.5
ghcr.io/siderolabs/talos:v1.14.5
ghcr.io/siderolabs/talosctl-all:v1.14.5
ghcr.io/siderolabs/overlays:v1.14.5
ghcr.io/siderolabs/extensions:v1.14.5