siderolabs/talos v1.5.0

on GitHub

Talos 1.5.0 (2023-08-17)

Welcome to the v1.5.0 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Extension Services

Talos now supports setting environmentFile for an extension service container spec. Refer: https://www.talos.dev/v1.5/advanced/extension-services/#container
The extension waits for the file to be present before starting the service.

Predictable Network Interface Names

Starting with version Talos 1.5, network interfaces are renamed to predictable names
same way as systemd does that in other Linux distributions.

The naming schema enx78e7d1ea46da (based on MAC addresses) is enabled by default, the order of interface naming decisions is:

• firmware/BIOS provided index numbers for on-board devices (example: eno1)
• firmware/BIOS provided PCI Express hotplug slot index numbers (example: ens1)
• physical/geographical location of the connector of the hardware (example: enp2s0)
• interfaces's MAC address (example: enx78e7d1ea46da)

The predictable network interface names features can be disabled by specifying net.ifnames=0 in the kernel command line.
Talos automatically adds the net.ifnames=0 kernel argument when upgrading from Talos versions before 1.5.

This change doesn't affect "cloud" platforms, like AWS, as Talos automatically adds net.ifnames=0 to the kernel command line.

Network KMS Disk Encryption

Talos now supports new type of encryption keys which are sealed/unsealed with an external KMS server:

systemDiskEncryption:
  ephemeral:
    keys:
      - kms:
          endpoint: https://1.2.3.4:443
        slot: 0

gRPC API definitions and a simple reference implementation of the KMS server can be found in this
repository.

KubePrism - Kubernetes API Server In-Cluster Load Balancer

Talos now supports configuring the KubePrism - Kubernetes API Server in-cluster load balancer with machine config
features.kubePrism.port and features.kubePrism.enabled fields.

If enabled, KubePrism binds to localhost and runs on the same port on every machine in the cluster.
The default value for KubePrism endpoint is https://localhost:7445.

The KubePrism is used by the kubelet, kube-scheduler, kube-controller-manager
and kube-proxy by default and can be passed to the CNIs like Cilium and Calico.

The KubePrism provides access to the Kubernetes API endpoint even if the external loadbalancer
is not healthy, provided that the worker nodes can reach to the controlplane machine addresses directly.

Machine Config option .machine.install.bootloader

The .machine.install.bootloader option in the machine config is deprecated and will be removed in Talos 1.6.
This was a no-op for a long time. The bootloader is always installed.

XFS Quota

Talos 1.5+ enables XFS project quota support by default, also enabling by default
kubelet feature gate LocalStorageCapacityIsolationFSQuotaMonitoring to use xfs quotas
to monitor volume usage instead of du.

This feature is controlled by the .machine.features.diskQuotaSupport field in the machine config,
it is set to true for new clusters.

When upgrading from a previous version, the feature can be enabled by setting the field to true.
On the first mount of a volume, the quota information will be recalculated, which may take some time.

RDMA/RoCE support

Talos no longer loads by default rdma_rxe Linux driver, which is required for RoCE support.
If the driver is required, it can be enabled by specifying rdma_rxe in the .machine.kernel.modules field in the machine config.

SecureBoot

Talos now supports generating a custom iso that can be used with SecureBoot. Key generation and enrolling has to be done manually.

talosctl image Command

A new set of commands was introduced to manage container images in the CRI:

• talosctl image list shows list of available images
• talosctl image pull allows to pre-pull an image into the CRI

Both new commands accept --namespace flag with two possible values:

• cri (default): images managed by the CRI (Kubernetes workloads)
• system: images managed by Talos (etcd and kubelet)

talosctl images Command

The command talosctl images was renamed to talosctl image default.

The backward-compatible alias is kept in Talos 1.5, but it will be dropped in Talos 1.6.

TPM Disk Encryption

Talos now supports encrypting STATE/EPHEMERAL with keys bound to a TPM device. The TPM device must be TPM2.0 compatible.
This is ideally supported when booting with new Talos SecureBoot UKI ISOs/Metal images. This feature would still work if SecureBoot
is not enabled for UKI images, but not recommended since there is no way to verify the trust of the bootloader.

Example machine config:

systemDiskEncryption:
  ephemeral:
    provider: luks2
    keys:
      - slot: 0
        tpm: {}
  state:
    provider: luks2
    keys:
      - slot: 0
        tpm: {}

Component Updates

• Linux: 6.1.45
• containerd: 1.6.23
• runc: 1.1.9
• etcd: 3.5.9
• Kubernetes: 1.28.0
• Flannel: 0.22.1

Talos is built with Go 1.20.7.

talosctl upgrade-k8s Image Pre-pulling

The command talosctl upgrade-k8s now by default pre-pulls images for Kubernetes controlplane components
and kubelet. This provides an early check for missing images, and minimizes downtime during Kubernetes
rolling component update.

Contributors

• Andrey Smirnov
• Noel Georgi
• Dmitriy Matrenichev
• Andrey Smirnov
• Utku Ozdemir
• Artem Chernyshev
• Spencer Smith
• Christian Rolland
• Steve Francis
• Andrei Kvapil
• Nanfei Chen
• Nico Berlee
• Alex Corcoles
• Alex Corcoles
• Alex Lubbock
• Artem Chernyshev
• Budiman Jojo
• Chris Hoffman
• DJAlPee
• Dennis Marttinen
• Eirik Askheim
• Florian Klink
• Henk Kraal
• Igor Rzegocki
• James Callahan
• Jared Davenport
• LukasAuerbeck
• Markus Reiter
• Michael A. Davis
• Michael Fornaro
• Niklas Wik
• Piotr Maksymiuk
• Ricky Sadowski
• Roee Klinger
• Sacha Trémoureux
• Scott Cariss
• Serge Logvinov
• Thomas Lemarchand
• Thomas Perronin
• Tim Jones
• Victor Bajada
• Walt Chen
• bdronneau

Changes

Changes since v1.5.0-beta.1

Changes from siderolabs/crypto

Changes from siderolabs/discovery-api

Changes from siderolabs/discovery-client

Changes from siderolabs/extras

Changes from siderolabs/gen

Changes from siderolabs/go-blockdevice

Changes from siderolabs/go-debug

Changes from siderolabs/go-kubernetes

Changes from siderolabs/go-loadbalancer

Changes from siderolabs/go-pcidb

Changes from siderolabs/kms-client

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

• github.com/BurntSushi/toml v1.2.1 -> v1.3.2
• github.com/aws/aws-sdk-go-v2/config v1.18.32 new
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.7 new
• github.com/aws/smithy-go v1.14.0 new
• github.com/beevik/ntp v0.3.0 -> v1.2.0
• github.com/benbjohnson/clock v1.1.0 -> v1.3.5
• github.com/cenkalti/backoff/v4 v4.2.0 -> v4.2.1
• github.com/containerd/containerd v1.6.19 -> v1.6.23
• github.com/containerd/typeurl/v2 v2.1.1 new
• github.com/containernetworking/plugins v1.2.0 -> v1.3.0
• github.com/coreos/go-iptables v0.6.0 -> v0.7.0
• github.com/cosi-project/runtime v0.3.0 -> v0.3.1
• github.com/docker/distribution v2.8.1 -> v2.8.2
• github.com/docker/docker v23.0.2 -> v24.0.5
• github.com/ecks/uefi caef65d070eb new
• github.com/emicklei/dot v1.4.2 -> v1.6.0
• github.com/foxboron/go-uefi 32187aa193d0 new
• github.com/google/go-containerregistry v0.15.2 new
• github.com/google/go-tpm v0.9.0 new
• github.com/gopacket/gopacket v1.1.1 new
• github.com/hashicorp/go-envparse v0.1.0 new
• github.com/hashicorp/go-getter/v2 v2.2.1 new
• github.com/hetznercloud/hcloud-go/v2 v2.0.0 new
• github.com/insomniacslk/dhcp 74ae03f2425e -> 0f9eb93a696c
• github.com/jsimonetti/rtnetlink v1.3.1 -> v1.3.4
• github.com/mattn/go-isatty v0.0.18 -> v0.0.19
• github.com/mdlayher/ethtool ba3b4bc2e02c -> v0.1.0
• github.com/mdlayher/genetlink v1.3.1 -> v1.3.2
• github.com/mdlayher/netlink v1.7.1 -> v1.7.2
• github.com/mdlayher/netx c711c2f8512f -> 7e21880baee8
• github.com/nberlee/go-netstat v0.1.1 -> v0.1.2
• github.com/opencontainers/go-digest v1.0.0 new
• github.com/opencontainers/image-spec v1.1.0-rc2 -> v1.1.0-rc4
• github.com/packethost/packngo v0.29.0 -> v0.30.0
• github.com/prometheus/procfs v0.9.0 -> v0.11.1
• github.com/rivo/tview 281d14d896d7 -> 6cc0565babaf
• github.com/rs/xid v1.4.0 -> v1.5.0
• github.com/scaleway/scaleway-sdk-go v1.0.0-beta.15 -> v1.0.0-beta.20
• github.com/siderolabs/crypto v0.4.0 -> v0.4.1
• github.com/siderolabs/discovery-api v0.1.2 -> v0.1.3
• github.com/siderolabs/discovery-client v0.1.4 -> v0.1.5
• github.com/siderolabs/extras v1.4.0-1-g9b07505 -> v1.5.0
• github.com/siderolabs/gen v0.4.3 -> v0.4.5
• github.com/siderolabs/go-blockdevice v0.4.4 -> v0.4.6
• github.com/siderolabs/go-debug v0.2.2 -> v0.2.3
• github.com/siderolabs/go-kubernetes v0.2.0 -> v0.2.2
• github.com/siderolabs/go-loadbalancer v0.2.1 -> v0.3.2
• github.com/siderolabs/go-pcidb v0.1.0 -> v0.2.0
• github.com/siderolabs/kms-client v0.1.0 new
• github.com/siderolabs/pkgs v1.4.1-5-ga333a84 -> v1.5.0-6-g2f2c9cd
• github.com/siderolabs/talos/pkg/machinery v1.4.0 -> v1.5.0
• github.com/siderolabs/tools v1.4.0-1-g955aabc -> v1.5.0
• github.com/spf13/cobra v1.6.1 -> v1.7.0
• github.com/stretchr/testify v1.8.2 -> v1.8.4
• github.com/vmware-tanzu/sonobuoy v0.56.16 -> v0.56.17
• go.etcd.io/etcd/api/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/client/pkg/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/client/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/etcdutl/v3 v3.5.8 -> v3.5.9
• go.uber.org/zap v1.24.0 -> v1.25.0
• go4.org/netipx f1b76eb4bb35 -> ec4c8b891b28
• golang.org/x/net v0.8.0 -> v0.13.0
• golang.org/x/sync v0.1.0 -> v0.3.0
• golang.org/x/sys v0.6.0 -> v0.10.0
• golang.org/x/term v0.6.0 -> v0.10.0
• golang.org/x/text v0.11.0 new
• golang.zx2c4.com/wireguard/wgctrl 9c5414ab4bde -> 925a1e7659e6
• google.golang.org/grpc v1.54.0 -> v1.57.0
• google.golang.org/protobuf v1.30.0 -> v1.31.0
• k8s.io/api v0.27.1 -> v0.28.0
• k8s.io/apimachinery v0.27.1 -> v0.28.0
• k8s.io/apiserver v0.27.1 -> v0.28.0
• k8s.io/client-go v0.27.1 -> v0.28.0
• k8s.io/component-base v0.27.1 -> v0.28.0
• k8s.io/cri-api v0.27.1 -> v0.28.0
• k8s.io/klog/v2 v2.90.1 -> v2.100.1
• k8s.io/kubectl v0.27.1 -> v0.28.0
• k8s.io/kubelet v0.27.1 -> v0.28.0
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.68 -> v1.2.69

Previous release can be found at v1.4.0

Images

ghcr.io/siderolabs/flannel:v0.22.1
ghcr.io/siderolabs/install-cni:v1.5.0
registry.k8s.io/coredns/coredns:v1.10.1
gcr.io/etcd-development/etcd:v3.5.9
registry.k8s.io/kube-apiserver:v1.28.0
registry.k8s.io/kube-controller-manager:v1.28.0
registry.k8s.io/kube-scheduler:v1.28.0
registry.k8s.io/kube-proxy:v1.28.0
ghcr.io/siderolabs/kubelet:v1.28.0
ghcr.io/siderolabs/installer:v1.5.0
registry.k8s.io/pause:3.6