siderolabs/talos v1.2.0-alpha.1

on GitHub

Talos 1.2.0-alpha.1 (2022-07-28)

Welcome to the v1.2.0-alpha.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Generating Talos secrets from PKI directory

It is now possible to generate a secrets bundle from a Kubernetes PKI directory (e.g. /etc/kubernetes/pki).

You can also specify a bootstrap token to be used in the secrets bundle.

This secrets bundle can then be used to generate a machine config.

This facilitates migrating clusters (e.g. created using kubeadm) to Talos.

talosctl gen secrets --kubernetes-bootstrap-token znzio1.1ifu15frz7jd59pv --from-kubernetes-pki /etc/kubernetes/pki
talosctl gen config --with-secrets secrets.yaml my-cluster https://172.20.0.1:6443

Kubernetes ControlPlane Components

Talos now run all Kubernetes Control Plane Components with the CRI default Seccomp Profile and other recommendations as described in
KEP-2568.

Kubelet Default Runtime Seccomp Profile

Talos now runs Kubelet with the CRI default Seccomp Profile enabled.
This can be disabled by setting .machine.kubelet.defaultRuntimeSeccompProfileEnabled to false.

This is not enabled automatically on upgrades, so upgrading to Talos v1.2 needs this to be explicitly enabled.

Network bridge support

Talos now supports configuring Linux bridges. It can be configured in the machine config like the following:

machine:
  network:
    interfaces:
      - interface: br0
        bridge:
          stp:
            enabled: true
          interfaces:
            - eth0
            - eth1

See documentation for more details.

VLAN support in cmdline arguments

Talos now supports dracut-style vlan kernel argument to allow
installing Talos Linux in networks where ports are not tagged
with a default VLAN:

vlan=eth1.5:eth1 ip=172.20.0.2::172.20.0.1:255.255.255.0::eth1.5:::::

Packet Capture

Talos now supports capturing packets on a network interface with talosctl pcap command:

talosctl pcap --interface eth0

Seccomp Profiles

Talos now supports creating custom seccomp profiles on the host machine which in turn can be used by Kubernetes workloads.
It can be configured in the machine config as below:

machine:
  seccompProfiles:
    - name: audit.json
      value:
        defaultAction: SCMP_ACT_LOG
    - name: deny.json
      value: {"defaultAction":"SCMP_ACT_LOG"}

This profile data can be either configured as a YAML definition or as a JSON string.

The profiles are created on the host under /var/lib/seccomp/profiles and bind mounted at /var/lib/kubelet/seccomp/profiles so Kubelet can use it.

See documentation for more details.

Stable Default Hostname

Talos now generates the default hostname (when there is no explicitly specified hostname) for the nodes based on the
node id (e.g. talos-2gd-76y) instead of using the DHCP assigned IP address (e.g. talos-172-20-0-2).

This ensures that the node hostname is not changed when DHCP assigns a new IP to a node.

Strategic merge machine configuration patching

In addition to JSON (RFC6902) patches Talos now supports strategic merge patching.

For example, machine hostname can be set with the following patch:

machine:
  network:
    hostname: worker1

Patch format is detected automatically.

Variable substitution for URL query parameter in the talos.config kernel parameter

The kernel parameter talos.config can now substitute system information into placeholders inside its URL query values. This example shows all supported variables:

http://example.com/metadata?h=${hostname}&m=${mac}&s=${serial}&u=${uuid}

Component Updates

• Linux: 5.15.57

Talos is built with Go 1.18.4.

Contributors

• Andrey Smirnov
• Noel Georgi
• Utku Ozdemir
• Dmitriy Matrenichev
• Philipp Sauter
• Tim Jones
• Spencer Smith
• Artem Chernyshev
• Davincible
• AMet
• Alex Wied
• Bermi Ferrer
• Christoph Schmatzler
• Dennis Marttinen
• Eirik Askheim
• Florian Klink
• Han Cen
• Larry Rosenman
• Markus Reiter
• Matthew Richardson
• Nico Berlee
• Rio Kierkels
• RyanSquared
• Serge Logvinov
• Seán C McCord
• hobyte
• nett_hier
• zebernst

Changes

Changes since v1.2.0-alpha.0

Changes from siderolabs/extras

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Changes from talos-systems/crypto

Changes from talos-systems/go-blockdevice

Changes from talos-systems/grpc-proxy

Dependency Changes

• cloud.google.com/go/compute v1.6.1 -> v1.7.0
• github.com/BurntSushi/toml v1.1.0 -> v1.2.0
• github.com/aws/aws-sdk-go v1.44.24 -> v1.44.61
• github.com/containerd/containerd v1.6.4 -> v1.6.6
• github.com/containernetworking/cni v1.1.0 -> v1.1.1
• github.com/cosi-project/runtime 95d06feaf8b5 -> 22c6aa1ca7ec
• github.com/docker/docker v20.10.16 -> v20.10.17
• github.com/emicklei/dot v0.16.0 -> v1.0.0
• github.com/google/gopacket v1.1.19 new
• github.com/google/nftables a9775fb167d2 -> a346d51f53b3
• github.com/hashicorp/go-getter v1.6.1 -> v1.6.2
• github.com/hashicorp/go-version v1.5.0 -> v1.6.0
• github.com/hetznercloud/hcloud-go v1.33.2 -> v1.35.1
• github.com/martinlindhe/base36 v1.1.1 new
• github.com/packethost/packngo v0.24.0 -> v0.25.0
• github.com/rivo/tview 9994674d60a8 -> 73bf2902b59a
• github.com/siderolabs/extras v1.1.0-1-g5800284 -> v1.2.0-alpha.0-1-g17a319f
• github.com/siderolabs/pkgs v1.1.0-8-gfa9a488 -> v1.2.0-alpha.0-23-gdcc0311
• github.com/siderolabs/tools v1.1.0-1-g134974c -> v1.2.0-alpha.0-4-g0d669dd
• github.com/spf13/cobra v1.4.0 -> v1.5.0
• github.com/stretchr/testify v1.7.1 -> v1.8.0
• github.com/talos-systems/crypto v0.3.5 -> e9df1b8ca74c
• github.com/talos-systems/go-blockdevice v0.3.2 -> v0.3.4
• github.com/talos-systems/grpc-proxy v0.3.0 -> v0.3.1
• github.com/vishvananda/netlink v1.2.0-beta -> v1.2.1-beta.2
• github.com/vmware-tanzu/sonobuoy v0.56.6 -> v0.56.8
• github.com/vmware/govmomi v0.28.0 -> v0.29.0
• golang.org/x/net 5463443f8c37 -> a158d28d115b
• golang.org/x/sync 0976fa681c29 -> 886fb9371eb4
• golang.org/x/sys bc2c85ada10a -> 8c9f86f7a55f
• golang.org/x/term 065cf7ba2467 -> a9ba230a4035
• golang.org/x/time 583f2d630306 -> e5dcc9cfc0b9
• google.golang.org/grpc v1.46.2 -> v1.48.0
• gopkg.in/yaml.v3 496545a6307b -> v3.0.1
• inet.af/netaddr c74959edd3b6 -> 097006376321
• k8s.io/api v0.24.2 -> v0.24.3
• k8s.io/apiserver v0.24.2 -> v0.24.3
• k8s.io/client-go v0.24.2 -> v0.24.3
• k8s.io/component-base v0.24.2 -> v0.24.3
• k8s.io/kubectl v0.24.2 -> v0.24.3
• k8s.io/kubelet v0.24.2 -> v0.24.3
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.64 -> v1.2.65

Previous release can be found at v1.1.0

Images

ghcr.io/siderolabs/flannel:v0.18.1
ghcr.io/siderolabs/install-cni:v1.2.0-alpha.0-1-g17a319f
docker.io/coredns/coredns:1.9.3
gcr.io/etcd-development/etcd:v3.5.4
k8s.gcr.io/kube-apiserver:v1.24.3
k8s.gcr.io/kube-controller-manager:v1.24.3
k8s.gcr.io/kube-scheduler:v1.24.3
k8s.gcr.io/kube-proxy:v1.24.3
ghcr.io/siderolabs/kubelet:v1.24.3
ghcr.io/siderolabs/installer:v1.2.0-alpha.1
k8s.gcr.io/pause:3.6