siderolabs/talos v1.15.0-alpha.1

on GitHub

Talos 1.15.0-alpha.1 (2026-10-13)

Welcome to the v1.15.0-alpha.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Boot Partition Wait

Talos now waits for the partition it was booted from to be discovered before declaring the system volumes (META, STATE) missing
and entering maintenance mode, so that disks enumerated late (SD cards, USB, some RAID controllers) are not mistaken for a fresh machine.

On UEFI systems booted via systemd-boot the boot partition comes from the LoaderDevicePartUUID EFI variable, while the GRUB configuration
now passes the talos.boot.partuuid=<UUID> kernel argument (probed by GRUB at boot). The detected boot partition is published as the bootpartition resource.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

containerd only migrates configuration from older versions, so any custom CRI configuration provided via
CRICustomizationConfig documents (or shipped by system extensions) is now interpreted as version 4, and settings
which moved in version 4 are silently ignored (only a Ignoring unknown key in TOML warning is logged by containerd).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

For example, the containerd metrics customization documented for previous versions of Talos:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [metrics]
    address = "0.0.0.0:11234"

should now be written as:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [plugins."io.containerd.server.v1.metrics"]
    address = "0.0.0.0:11234"

Note that [debug] level, format and log_trace_id stay at the top level, and that the ttrpc address is no longer
derived from the grpc address: if the grpc address is customized, the ttrpc plugin address has to be set explicitly.

Unified --namespace Flag

talosctl containers, logs, stats and restart now select the containerd namespace through the same --namespace flag and vocabulary already used by talosctl image and talosctl debug: system (the default), cri for Kubernetes workloads, and taloscontainers for containers declared via a ContainerConfig document.

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

talosctl image list also supports --namespace taloscontainers, to inspect images pulled for ContainerConfig containers. talosctl debug does not support the taloscontainers namespace.

CPU Scaling Configuration

CPU frequency scaling can now be configured declaratively with the CPUScalingConfig document, instead of through kernel arguments
or raw SysfsConfig keys:

apiVersion: v1alpha1
kind: CPUScalingConfig
name: all-cores
selector:
  match: true
governor: performance

Settings apply to the cpufreq policies matched by the selector, which targets cores by property rather than by index, so a machine
whose cores are not uniform can be configured without hardcoding how many it has:

apiVersion: v1alpha1
kind: CPUScalingConfig
name: performance-cores
selector:
  match: cpu.core_type == "performance"
governor: performance
---
apiVersion: v1alpha1
kind: CPUScalingConfig
name: efficiency-cores
selector:
  match: cpu.core_type == "efficiency"
governor: powersave

The selector matches against the fields of the CPUScalingStatus resource, and may also set energyPerformancePreference,
minFrequencyKhz and maxFrequencyKhz. Where several documents match the same policy, the one whose name sorts first wins, and the
document which claimed a policy is reported on the resulting CPUScalingSpec resource. Removing the configuration restores the
values the machine booted with.

Setting a cpufreq attribute through both CPUScalingConfig and SysfsConfig is rejected, as the two would otherwise overwrite each
other continuously.

Disk SMART Status

Talos can now collect SMART (Self-Monitoring, Analysis and Reporting Technology) health information from disks,
exposed via the new SMARTStatus resource (one per disk, keyed by the disk device name).

Collection is controlled by the presence of the new DiskSMARTConfig document: while the document is part of
the machine configuration SMART status is collected, and removing the document disables collection (any
SMARTStatus resources already produced are removed as well). There is no enabled field.

apiVersion: v1alpha1
kind: DiskSMARTConfig
interval: 30m0s

talosctl gen config and talosctl cluster create emit this document by default, so SMART status collection
is enabled by default for machine configurations generated by Talos 1.15. Clusters upgraded from an earlier
version keep their existing machine configuration, which carries no DiskSMARTConfig document, so SMART
status collection stays off there until the document is added.

Rotational disks are never spun up just to be probed: a disk in standby is detected via ATA
CHECK POWER MODE and its SMART data is left untouched until it is active again.

To retrieve SMART statuses:

talosctl get smart

The resource reports an overall health verdict, temperature, power-on hours and power cycles, NVMe wear
indicators (percent used, available spare, critical warning, media errors) and, for ATA/SATA disks, the raw
SMART attribute table with per-attribute thresholds.

Disk Free

A new talosctl diskfree command (aliased to df) reports storage and inode usage for mounted volumes.

Extension Service Configuration

ExtensionServiceConfig is supported only for extension services whose service manifest explicitly declares a configuration dependency:

depends:
  - configuration: true

Using ExtensionServiceConfig with a service that does not declare this dependency is unsupported and has undefined startup behavior.
The service might start before its configuration is rendered, leaving config files or environment variables unavailable until a later service restart.
Extension authors must declare the dependency before documenting ExtensionServiceConfig support.

talosctl gen removed subcommands

The following talosctl gen subcommands have been removed:

• talosctl gen ca
• talosctl gen crt
• talosctl gen csr
• talosctl gen key
• talosctl gen keypair

These commands where historically used to generate pieces of Talos PKI, but they are no longer needed
as talosctl gen config and talosctl gen secrets now generate all required PKI material automatically.

Blank Virtual Machine Disks

A virtual machine disk can now be provisioned as an empty volume in a storage pool, rather than only
as a CD-ROM attached from a content library:

apiVersion: v1alpha1
kind: VirtualMachineConfig
name: vm1
disks:
  - name: data
    pool: pool1
    size: 100GiB
    format: qcow2
    provision:
      blank: {}

The pool must be declared by a StoragePool document in the same machine configuration; a disk
naming an undeclared pool is now a configuration error rather than a virtual machine that silently
never starts.

Four behaviours are worth knowing before you rely on this:

• Volumes are adopted by name and are never deleted. The volume is named after the virtual
  machine and the disk, so removing the disk from the configuration leaves the data in place, and
  re-declaring the same virtual machine and disk names in the same pool reattaches it. Reclaiming
  the space is a deliberate, out-of-band act. talosctl get storagepoolvolumestatuses lists
  managed volumes, not retained orphan files: their statuses disappear when their requests and
  consumers are gone. Inspect the pool's backing directory to discover retained files before
  reclaiming space; confirm a file is no longer in use before deleting it.
• Disks grow only. Raising size grows the volume the next time no virtual machine has it open,
  because growing one underneath a running guest corrupts qcow2 metadata and is invisible to the
  guest for raw. The pending growth is reported on the volume's status.
• A smaller size is reported and ignored. Shrinking would truncate a filesystem the guest laid
  out, so it is refused rather than applied; the disk stays attachable and the virtual machine keeps
  running.
• Remove all virtual machine references together with a StoragePool document. Removing a
  referenced pool alone is rejected by configuration validation. Remove or update every virtual
  machine referencing it in the same configuration change. During teardown, consumers release
  the pool before it is undefined and its backing directory can be unmounted. The volume files
  survive.

Provisioning a disk from a content library image is not implemented yet; provision.fromImage is
still only supported on a cdrom.

Ignore Ctrl-Alt-Delete

Setting ignoreCtrlAltDelete: true in the SecurityProfileConfig document makes Talos log and ignore Ctrl-Alt-Delete instead of rebooting the machine.
Ctrl-Alt-Delete still reboots the machine until a configuration with this option is applied.

IPVS Support

Following Kubernetes deprecation of IPVS support (kube-proxy), Talos Linux now ships IPVS as kernel modules which are not loaded by default.

If you require IPVS support, you can enable it by loading the following kernel modules:

• ip_vs (core)
• ip_vs_rr, ip_vs_wrr, ip_vs_lc, ip_vs_sh or ip_vs_mh (scheduling algorithms)
• xt_ipvs (nftables/iptables match)

Kernel Log Extra Tags

The KmsgLogConfig document now supports an extraTags field which attaches additional key-value pairs
to every kernel log message sent to that destination:

apiVersion: v1alpha1
kind: KmsgLogConfig
name: apiSink
url: https://kmsglog.api/logs
extraTags:
  cluster: staging-west
  node: worker-1

Tags are scoped to the destination they are configured on, so different endpoints can receive different tags.
The keys facility, seq, clock, priority, msg, talos-time and talos-level are reserved and rejected,
as they are set by Talos itself.

Kubelet Image GC Thresholds

Talos now defaults kubelet imageGCHighThresholdPercent to 75 and imageGCLowThresholdPercent to 65 (upstream defaults are 85 and 80).

The upstream image GC high threshold matches the default imagefs.available<15% hard eviction threshold, so the node was put
into DiskPressure (and tainted for evictionPressureTransitionPeriod) before image GC had a chance to run.

The defaults are applied only if neither of the thresholds is set in machine.kubelet.extraConfig.
On upgrade, nodes with disk usage above 75% will garbage collect unused images.

Kubelet Resource Manager State

Talos now validates the kubelet CPU manager and memory manager state files (/var/lib/kubelet/cpu_manager_state, /var/lib/kubelet/memory_manager_state)
the same way kubelet does on startup, and removes a state file kubelet would refuse to load before starting kubelet.

Previously only a change of the manager policy was detected, so changing e.g. reservedSystemCPUs or reservedMemory, or
a change of the CPU/NUMA topology of the machine, left kubelet unable to start until the state file was removed manually.

Only the rendered KubeletConfiguration (machine.kubelet.extraConfig) is checked: the resource manager settings passed as kubelet
command line flags via machine.kubelet.extraArgs (e.g. --cpu-manager-policy, --reserved-cpus) are not taken into account.

KubeSpan Peer Endpoint Filters

KubeSpan now supports filtering the endpoints received from other peers via filters.peerEndpoints in the KubeSpanConfig document.

While filters.endpoints filters the addresses a node advertises to the whole cluster, filters.peerEndpoints filters the endpoints
received from other peers before the node connects to them, affecting only that node. This allows excluding peer-advertised endpoints
which are known to be unreachable from a node (e.g., addresses of a private network the node is not connected to), so that KubeSpan
endpoint rotation never attempts them.

LLDP Neighbor Discovery

Talos now listens for LLDP on physical Ethernet interfaces and reports neighbors through the LLDPNeighborStatus resource.
Reported information includes chassis and port IDs, system and port descriptions, system names, management addresses, and VLANs.
The built-in listener does not transmit advertisements; use the lldpd system extension when advertising is required.

Secure Boot images no longer have lockdown=confidentiality enabled by default

Secure Boot images no longer have lockdown=confidentiality enabled by default.
This change was made to improve compatibility with eBPF tooling under default schematic.
This means that Secure Boot images will now have lockdown=integrity enabled by default (implicitly), which is the recommended setting for most users.
Users can override it by adding lockdown=confidentiality to the kernel command line through Image Factory if they require it.

MACVLAN Links

Talos Linux now supports creating MACVLAN links with a new MacVLANConfig document:

apiVersion: v1alpha1
kind: MacVLANConfig
name: eth0.macvlan
parent: eth0
mode: bridge # optional, defaults to `bridge`
addresses:
  - address: 192.168.1.100/24

The source mode is not supported yet, as it requires a list of allowed source MAC addresses.

Multipath Configuration

The multipath-tools system extension now reads /etc/multipath.conf from the Talos host instead of using ExtensionServiceConfig.
The multipathd service waits for this file and bind-mounts it read-only into its service container.

Before updating the extension, apply a machine config patch that deletes the existing ExtensionServiceConfig document and adds an EtcFileConfig document:

apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: multipathd
$patch: delete
---
apiVersion: v1alpha1
kind: EtcFileConfig
name: multipath.conf
mode: 0o644
contents: |
  defaults {
      user_friendly_names yes
      find_multipaths no
      path_selector "round-robin 0"
  }

The extension does not provide a default configuration, so multipathd remains waiting until /etc/multipath.conf is present.

NFS External Volumes

Talos now supports NFS as an ExternalVolumeConfig filesystem type alongside virtiofs, allowing nodes to mount network exports at /var/mnt/<name> through the existing block volume machinery.

apiVersion: v1alpha1
kind: ExternalVolumeConfig
name: shared
filesystemType: nfs
mount:
  nfs:
    server: 10.0.0.10
    path: /export
    version: "4.1"

Supported version values are 3, 4, 4.1, and 4.2.
The mount.nfs spec configures the kernel NFS client:

• Connectivity: server (hostname or IP; IPv6 is bracketed automatically) and absolute path are required; optional port, transport (tcp/udp), and NFSv3-only mountPort/mountTransport (otherwise rpcbind discovery is used).
• NFSv3 locking: locking (local default / remote) controls nolock/lock; Talos does not run rpc.statd, so local (nolock) is the safe default. You need rpc.statd extension for remote locking.
• Recovery: recovery (hard/soft/soft-error) maps to hard/soft/softerr.
• Tuning: timeout (timeo, deciseconds), retransmissions (retrans), readSize/writeSize (rsize/wsize, 1024–1048576 multiples of 1024), connections (nconnect, 1–16, TCP only), reservedPort (resvport/noresvport), and security (none/sys; Kerberos flavors are unsupported as Talos does not run rpc.gssd).
• NFSv4 enforces tcp transport.

Common mount flags (readOnly, disableAccessTime, secure) apply as with other volume types.
Validation rejects mountPort/mountTransport/locking outside NFSv3 and udp for NFSv4.

NUMA Topology and VM Placement Validation

Talos reports host NUMA nodes, CPU membership and total node memory through the NUMATopology resource.
Explicit VM CPU pins and memory-node selections are checked against the host before starting or replacing a guest.
Invalid placement leaves an existing guest running; CPUs and guest memory may intentionally use different nodes.
This validates placement, not available memory capacity or reservations. Host inventory is not exposed in container mode.

Route Updates

RouteSpec resource IDs now match the key the Linux kernel uses for routes: routing table, address family, destination and priority (metric),
e.g. inet4/10.0.0.0/8/1024 instead of inet4/10.0.0.1/10.0.0.0/8/1024.
The gateway, the output link and the multipath next-hops are no longer part of the ID, so changing them updates the route in place
(RTM_NEWROUTE with NLM_F_REPLACE) without the route ever being missing, e.g. when a BGP route switches between a single next-hop and ECMP.

Routes which differ only in the next-hops (which can't be installed into the kernel at the same time) are now merged into a single route,
with the higher configuration layer taking precedence.
RouteStatus resource IDs are not changed.

Permissions of the Generated Files

talosctl now writes every file which might contain secrets with 0600 permissions (owner read/write only),
and it restricts the permissions of the files it overwrites as well.

This affects the machine configuration (talosctl gen config, talosctl machineconfig patch,
talosctl cluster create --skip-injecting-config), talosconfig and kubeconfig.

Time Check API

The TimeService/TimeCheck API (talosctl time --check) is no longer available to the os:reader role, as it allows querying
arbitrary time servers from the node. The TimeService/Time API (querying the configured time server) is still available to os:reader.

PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under /dev,
the name should start with ptp (e.g. /dev/ptp0, /dev/ptp_kvm), and the device should be a PTP character device.

Filesystem Trim Chunking

The FilesystemTrimConfig document (and the per-volume trim settings) now support chunkSize, chunkDelay and minLength options.

By default, the whole filesystem is trimmed at once (same as the fstrim command), which issues discards for all free space back-to-back
and might cause latency spikes for other workloads on the same disk (e.g. etcd).
Setting chunkSize splits the trim into multiple operations with chunkDelay in between, while minLength skips free ranges smaller than the specified size.

Component Updates

Linux: 6.18.55
Kubernetes: 1.38.0-alpha.2
containerd: 2.3.6
runc: 1.5.2
CoreDNS: 1.14.7
systemd-udevd: 262

Talos is built with Go 1.27.2.

Virtual Machine Serial Console

Talos-managed virtual machines now expose their serial console over the Talos API, with no host shell access required.

talosctl hypervisor console <vm-name> attaches to the live serial console of a running VM.
Press Ctrl-] to detach without stopping the VM; Ctrl-C is forwarded to the guest.
Only one session can be attached to a VM at a time, and previous output is not replayed.
The command is supported on Unix clients only.

Serial output is also persisted on the host (with bounded retention), and can be read with talosctl logs --kind=vm <vm-name>,
including --tail and --follow. The new --kind flag (container, vm or service) selects the log source explicitly;
omitting it keeps the previous service/container routing.

Both the console and the VM logs require the os:admin role and a single target node.

Virtual Machine VNC Console

The new talosctl hypervisor vnc <vm-name> command forwards a virtual machine's graphical console to a local loopback TCP port.
Enable console.vnc.enabled in its VirtualMachineConfig; access requires the os:admin role and exactly one target node.

The listener accepts one viewer at a time and supports reconnecting without restarting the command.
Use a viewer that supports unauthenticated RFB.
Talos authenticates the tunnel, and no VNC TCP port is opened on the node.

VXLAN Links

Talos Linux now supports creating VXLAN links with a new VXLANConfig document:

apiVersion: v1alpha1
kind: VXLANConfig
name: vxlan100
id: 100 # VXLAN network identifier (VNI)
parent: eth0
local: 10.255.0.1 # or `group:` for a multicast group, but not both
port: 4789 # optional, defaults to 4789
learning: false # optional, defaults to true
addresses:
  - address: 192.168.1.100/24

Workload Memory Limits

The new WorkloadResourceConfig document sets independent aggregate memory limits for Kubernetes pods, Talos containers and virtual machines:

apiVersion: v1alpha1
kind: WorkloadResourceConfig
kubepods:
  memory:
    limit: 16GiB
taloscontainers:
  memory:
    limit: 4GiB
virtualMachines:
  memory:
    limit: 32GiB

Each root is optional. Limits are ceilings, not reservations, and do not cover swap or HugeTLB memory.
For kubepods, Talos derives systemReserved.memory so kubelet enforces the cap and adjusts Node Allocatable;
an explicit systemReserved.memory, conflicting kubelet flags or the Static memory manager cannot be combined with this limit.
Changing the Kubernetes cap restarts kubelet. Without Kubernetes, only the container and virtual machine limits apply.

Lowering a limit can OOM-kill workloads in that group, including QEMU guests or Kubernetes control-plane pods.
Talos exclusively owns memory.max on /taloscontainers and /virtualmachines.partition, even without this document.
Omitting their limits means unlimited aggregate memory; individual child limits still apply.
Kubelet system-reserved or kube-reserved memory enforcement on these roots is rejected regardless of this document;
CPU-only or compressible enforcement and reservations on unrelated roots remain supported.
Kubelet drop-in directories are rejected while any cap is active; without caps, their contents remain the operator's responsibility.
Removing the Kubernetes cap restores the original kubelet configuration. The document has no effect in container mode.

Contributors

• Andrey Smirnov
• Maja Bojarska
• Noel Georgi
• Mateusz Urbanek
• Utku Ozdemir
• Dmitrii Sharshakov
• Justin Garrison
• Orzelius
• Loki San
• Max Makarov
• Oscar Wieman
• immanuwell
• Jarrad S
• Sacha Weatherstone
• Aleksei Sviridkin
• Alexander Soelberg Heidarsson
• Angelos Petheriotis
• Brian Topping
• Christoph Engelbert (noctarius)
• Dennis Docter
• Dima Aratin
• Evan Champion
• GeertJohan
• Ian Atha
• Ivan Demchuk
• Joakim Nohlgård
• Kamil Szczygieł
• Karthik Chowdary
• Kuzia
• Licia Seiker
• Louis Deconinck
• Matt Layher
• MsfPablo
• Noel
• Oguz Kilcan
• Raphaël DUCOM
• Ryuki Maruyama
• Spencer Smith
• Steve Francis
• Steve Wills
• Tom Plant
• Winter
• dadbravo
• leppeK
• neiltalap
• saguila
• usman.malik_ext

Changes

Changes since v1.15.0-alpha.0

Changes from siderolabs/gen

Changes from siderolabs/go-debug

Changes from siderolabs/go-kubernetes

Changes from siderolabs/go-lldp

Changes from siderolabs/go-pcidb

Changes from siderolabs/pkgs

Changes from siderolabs/siderolink

Changes from siderolabs/tools

Dependency Changes

• cel.dev/cel-go v0.32.0 new
• cloud.google.com/go/compute/metadata v0.9.0 -> v0.9.1
• codeberg.org/miekg/dns v0.6.90 -> v0.6.114
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 -> v1.23.1
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 -> v1.14.1
• github.com/anatol/smart.go 486c28b93357 new
• github.com/aws/aws-sdk-go-v2 v1.43.4 -> v1.47.0
• github.com/aws/aws-sdk-go-v2/config v1.32.35 -> v1.33.5
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 -> v1.20.0
• github.com/aws/aws-sdk-go-v2/service/acm v1.43.4 -> v1.50.0
• github.com/aws/aws-sdk-go-v2/service/kms v1.55.4 -> v1.61.0
• github.com/aws/smithy-go v1.27.7 -> v1.28.2
• github.com/beevik/nts v0.3.1 -> v0.3.2
• github.com/bougou/go-ipmi v0.9.1 new
• github.com/containerd/containerd/v2 v2.3.4 -> v2.3.6
• github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5
• github.com/containernetworking/cni v1.3.0 -> v1.3.1
• github.com/digitalocean/go-libvirt 1a83157e1858 new
• github.com/digitorus/pkcs7 ffadbf3f398c new
• github.com/diskfs/go-diskfs v1.9.4 new
• github.com/docker/cli v29.7.2 -> v29.8.1
• github.com/dustin/go-humanize v1.0.1 -> v1.1.0
• github.com/google/cadvisor/lib v0.60.5 -> v0.60.6
• github.com/google/go-containerregistry v0.21.9 -> v0.22.1
• github.com/google/go-eventlog v0.0.2 new
• github.com/gopacket/gopacket v1.7.1 -> v1.7.2
• github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 -> v2.3.4
• github.com/hashicorp/go-getter/v2 v2.2.3 -> v2.2.4
• github.com/hetznercloud/hcloud-go/v2 v2.47.0 -> v2.48.0
• github.com/insomniacslk/dhcp c308df0fdcef -> 234b97448fae
• github.com/klauspost/compress v1.19.2 -> v1.20.0
• github.com/lestrrat-go/helium v0.8.0 new
• github.com/linode/go-metadata v0.3.0 -> v0.3.1
• github.com/marmos91/dittofs v0.32.0 new
• github.com/mdlayher/ethernet 529eae5b6118 new
• github.com/miekg/dns v1.1.72 -> v1.1.73
• github.com/moby/moby/api v1.55.0 -> v1.56.0
• github.com/moby/moby/client v0.5.1 -> v0.6.0
• github.com/osrg/gobgp/v4 v4.8.0 -> v4.9.0
• github.com/prometheus/procfs v0.21.1 -> v0.22.0
• github.com/siderolabs/gen v0.8.7 -> v0.8.8
• github.com/siderolabs/go-blockdevice/v2 v2.0.32 -> v2.0.36
• github.com/siderolabs/go-debug v0.6.2 -> v0.6.3
• github.com/siderolabs/go-kubernetes v0.2.41 -> v0.2.43
• github.com/siderolabs/go-lldp v0.1.0 new
• github.com/siderolabs/go-pcidb v0.3.3 -> v0.3.4
• github.com/siderolabs/pkgs v1.14.0-15-g2f03590 -> v1.15.0-alpha.0-52-g305b1b6
• github.com/siderolabs/siderolink v0.3.16 -> v0.3.18
• github.com/siderolabs/talos/pkg/machinery v1.14.0 -> v1.15.0-alpha.1
• github.com/siderolabs/tools v1.14.0-5-g87316ca -> v1.15.0-alpha.0-12-g32e115c
• github.com/sigstore/sigstore v1.10.9 -> v1.10.10
• github.com/sirupsen/logrus v1.9.4 -> v1.10.2
• github.com/ulikunitz/xz v0.5.16 -> v0.5.17
• go.etcd.io/etcd/api/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/client/pkg/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/client/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/etcdutl/v3 v3.7.1 -> v3.7.2
• go4.org/netipx fdeea329fbba -> 3075585bcbeb
• golang.org/x/oauth2 v0.36.0 -> v0.37.0
• golang.org/x/sync v0.22.0 -> v0.24.0
• golang.org/x/term v0.45.0 -> v0.47.0
• golang.org/x/time v0.15.0 -> v0.16.0
• google.golang.org/grpc v1.83.2 -> v1.84.0
• k8s.io/api v0.37.0 -> v0.38.0-alpha.2
• k8s.io/apiextensions-apiserver v0.37.0 -> v0.38.0-alpha.2
• k8s.io/apimachinery v0.37.0 -> v0.38.0-alpha.2
• k8s.io/apiserver v0.37.0 -> v0.38.0-alpha.2
• k8s.io/client-go v0.37.0 -> v0.38.0-alpha.2
• k8s.io/component-base v0.37.0 -> v0.38.0-alpha.2
• k8s.io/cri-api v0.37.0 -> v0.38.0-alpha.2
• k8s.io/kube-proxy v0.37.0 -> v0.38.0-alpha.2
• k8s.io/kube-scheduler v0.37.0 -> v0.38.0-alpha.2
• k8s.io/kubectl v0.37.0 -> v0.38.0-alpha.2
• k8s.io/kubelet v0.37.0 -> v0.38.0-alpha.2
• k8s.io/pod-security-admission v0.37.0 -> v0.38.0-alpha.2
• k8s.io/utils cf1189d6abe3 new
• libvirt.org/go/libvirtxml v1.12007.0 new
• sigs.k8s.io/hydrophone v0.7.0 -> v0.8.0

Previous release can be found at v1.14.0

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.7.2
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.38.0-alpha.2
registry.k8s.io/kube-controller-manager:v1.38.0-alpha.2
registry.k8s.io/kube-scheduler:v1.38.0-alpha.2
registry.k8s.io/kube-proxy:v1.38.0-alpha.2
ghcr.io/siderolabs/kubelet:v1.38.0-alpha.2
registry.k8s.io/networking/kube-network-policies:v1.1.2
ghcr.io/siderolabs/installer-base:v1.15.0-alpha.1
ghcr.io/siderolabs/imager:v1.15.0-alpha.1
ghcr.io/siderolabs/talos:v1.15.0-alpha.1
ghcr.io/siderolabs/talosctl-all:v1.15.0-alpha.1
ghcr.io/siderolabs/overlays:v1.15.0-alpha.1
ghcr.io/siderolabs/extensions:v1.15.0-alpha.1