siderolabs/talos v1.15.0-alpha.0

on GitHub

Talos 1.15.0-alpha.0 (2026-09-08)

Welcome to the v1.15.0-alpha.0 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

containerd only migrates configuration from older versions, so any custom CRI configuration provided via
CRICustomizationConfig documents (or shipped by system extensions) is now interpreted as version 4, and settings
which moved in version 4 are silently ignored (only a Ignoring unknown key in TOML warning is logged by containerd).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

For example, the containerd metrics customization documented for previous versions of Talos:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [metrics]
    address = "0.0.0.0:11234"

should now be written as:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [plugins."io.containerd.server.v1.metrics"]
    address = "0.0.0.0:11234"

Note that [debug] level, format and log_trace_id stay at the top level, and that the ttrpc address is no longer
derived from the grpc address: if the grpc address is customized, the ttrpc plugin address has to be set explicitly.

Unified --namespace Flag

talosctl containers, logs, stats and restart now select the containerd namespace through the same --namespace flag and vocabulary already used by talosctl image and talosctl debug: system (the default), cri for Kubernetes workloads, and taloscontainers for containers declared via a ContainerConfig document.

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

talosctl image list also supports --namespace taloscontainers, to inspect images pulled for ContainerConfig containers. talosctl debug does not support the taloscontainers namespace.

Disk Free

A new talosctl diskfree command (aliased to df) reports storage and inode usage for mounted volumes.

Extension Service Configuration

ExtensionServiceConfig is supported only for extension services whose service manifest explicitly declares a configuration dependency:

depends:
  - configuration: true

Using ExtensionServiceConfig with a service that does not declare this dependency is unsupported and has undefined startup behavior.
The service might start before its configuration is rendered, leaving config files or environment variables unavailable until a later service restart.
Extension authors must declare the dependency before documenting ExtensionServiceConfig support.

IPVS Support

Following Kubernetes deprecation of IPVS support (kube-proxy), Talos Linux now ships IPVS as kernel modules which are not loaded by default.

If you require IPVS support, you can enable it by loading the following kernel modules:

• ip_vs (core)
• ip_vs_rr, ip_vs_wrr, ip_vs_lc, ip_vs_sh or ip_vs_mh (scheduling algorithms)
• xt_ipvs (nftables/iptables match)

Kernel Log Extra Tags

The KmsgLogConfig document now supports an extraTags field which attaches additional key-value pairs
to every kernel log message sent to that destination:

apiVersion: v1alpha1
kind: KmsgLogConfig
name: apiSink
url: https://kmsglog.api/logs
extraTags:
  cluster: staging-west
  node: worker-1

Tags are scoped to the destination they are configured on, so different endpoints can receive different tags.
The keys facility, seq, clock, priority, msg, talos-time and talos-level are reserved and rejected,
as they are set by Talos itself.

KubeSpan Peer Endpoint Filters

KubeSpan now supports filtering the endpoints received from other peers via filters.peerEndpoints in the KubeSpanConfig document.

While filters.endpoints filters the addresses a node advertises to the whole cluster, filters.peerEndpoints filters the endpoints
received from other peers before the node connects to them, affecting only that node. This allows excluding peer-advertised endpoints
which are known to be unreachable from a node (e.g., addresses of a private network the node is not connected to), so that KubeSpan
endpoint rotation never attempts them.

Secure Boot images no longer have lockdown=confidentiality enabled by default

Secure Boot images no longer have lockdown=confidentiality enabled by default.
This change was made to improve compatibility with eBPF tooling under default schematic.
This means that Secure Boot images will now have lockdown=integrity enabled by default (implicitly), which is the recommended setting for most users.
Users can override it by adding lockdown=confidentiality to the kernel command line through Image Factory if they require it.

MACVLAN Links

Talos Linux now supports creating MACVLAN links with a new MacVLANConfig document:

apiVersion: v1alpha1
kind: MacVLANConfig
name: eth0.macvlan
parent: eth0
mode: bridge # optional, defaults to `bridge`
addresses:
  - address: 192.168.1.100/24

The source mode is not supported yet, as it requires a list of allowed source MAC addresses.

Multipath Configuration

The multipath-tools system extension now reads /etc/multipath.conf from the Talos host instead of using ExtensionServiceConfig.
The multipathd service waits for this file and bind-mounts it read-only into its service container.

Before updating the extension, apply a machine config patch that deletes the existing ExtensionServiceConfig document and adds an EtcFileConfig document:

apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: multipathd
$patch: delete
---
apiVersion: v1alpha1
kind: EtcFileConfig
name: multipath.conf
mode: 0o644
contents: |
  defaults {
      user_friendly_names yes
      find_multipaths no
      path_selector "round-robin 0"
  }

The extension does not provide a default configuration, so multipathd remains waiting until /etc/multipath.conf is present.

Component Updates

Linux: 6.18.49
Kubernetes: 1.37.0
containerd: 2.3.5
CoreDNS: 1.14.7

Talos is built with Go 1.26.8.

VXLAN Links

Talos Linux now supports creating VXLAN links with a new VXLANConfig document:

apiVersion: v1alpha1
kind: VXLANConfig
name: vxlan100
id: 100 # VXLAN network identifier (VNI)
parent: eth0
local: 10.255.0.1 # or `group:` for a multicast group, but not both
port: 4789 # optional, defaults to 4789
learning: false # optional, defaults to true
addresses:
  - address: 192.168.1.100/24

Contributors

• Andrey Smirnov
• Maja Bojarska
• Noel Georgi
• Mateusz Urbanek
• Dmitrii Sharshakov
• Utku Ozdemir
• Loki San
• Max Makarov
• Sacha Weatherstone
• Dennis Docter
• Dima Aratin
• Evan Champion
• Ivan Demchuk
• Kamil Szczygieł
• Kuzia
• Licia Seiker
• MsfPablo
• Noel
• Orzelius
• Oscar Wieman
• Raphaël DUCOM
• Spencer Smith
• Steve Francis
• Winter
• dadbravo
• neiltalap
• usman.malik_ext

Changes

Changes from siderolabs/go-debug

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

• github.com/containerd/containerd/v2 v2.3.4 -> v2.3.5
• github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5
• github.com/siderolabs/go-debug v0.6.2 -> v0.6.3
• github.com/siderolabs/pkgs v1.14.0-15-g2f03590 -> v1.15.0-alpha.0-24-g977b61f
• github.com/siderolabs/talos/pkg/machinery v1.14.0 -> v1.15.0-alpha.0
• github.com/siderolabs/tools v1.14.0-5-g87316ca -> v1.15.0-alpha.0-5-g09ccc74

Previous release can be found at v1.14.0

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:3.7.1
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.0
registry.k8s.io/kube-controller-manager:v1.37.0
registry.k8s.io/kube-scheduler:v1.37.0
registry.k8s.io/kube-proxy:v1.37.0
ghcr.io/siderolabs/kubelet:v1.37.0
registry.k8s.io/networking/kube-network-policies:v1.1.1
ghcr.io/siderolabs/installer-base:v1.15.0-alpha.0
ghcr.io/siderolabs/imager:v1.15.0-alpha.0
ghcr.io/siderolabs/talos:v1.15.0-alpha.0
ghcr.io/siderolabs/talosctl-all:v1.15.0-alpha.0
ghcr.io/siderolabs/overlays:v1.15.0-alpha.0
ghcr.io/siderolabs/extensions:v1.15.0-alpha.0