siderolabs/talos v1.7.0-beta.0

on GitHub

Talos 1.7.0-beta.0 (2024-04-05)

Welcome to the v1.7.0-beta.0 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

CA Rotation

Talos Linux now supports rotating the root CA certificate and key for Talos API and Kubernetes API.

Device Selectors

Talos Linux now supports physical: true qualifier for device selectors, it selects non-virtual network interfaces (i.e. en0 is selected, while bond0 is not).

DNS Caching

Talos Linux now provides a caching DNS resolver for host workloads (including host networking pods). It can be disabled with:

machine:
   features:
       hostDNS:
         enabled: false

Extension Services Config

Talos now supports supplying configuration files and environment variables for extension services.
The extension service configuration is a separate config document. An example is shown below:

---
apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: nut-client
configFiles:
  - content: MONITOR ${upsmonHost} 1 remote pass password
    mountPath: /usr/local/etc/nut/upsmon.conf
environment:
  - UPS_NAME=ups

For documentation, see Extension Services Config Files.

Note: The use of environmentFile in extension service spec is now deprecated and will be removed in a future release of Talos.
Use ExtensionServiceConfig instead.

Kubernetes Upgrade

The command talosctl upgrade-k8s now supports specifying custom image references for Kubernetes components via --*-image flags.
The default behavior is unchanged, and the flags are optional.

KubeSpan

Talos Linux disables by default a KubeSpan feature to harvest additional endpoints from KubeSpan members.
This feature turned out to be less helpful than expected and caused unnecessary performance issues.

Previous behavior can be restored with:

machine:
  network:
    kubespan:
        harvestExtraEndpoints: true

Logging

Talos Linux now supports setting extra tags when sending logs in JSON format:

machine:
  logging:
    destinations:
      - endpoint: "udp://127.0.0.1:12345/"
        format: "json_lines"
        extraTags:
          server: s03-rack07

Time Sync

Default NTP server was updated to be time.cloudflare.com instead of pool.ntp.org.
Default server is only used if the user does not specify any NTP servers in the configuration.

Talos Linux can now sync to PTP devices (e.g. provided by the hypervisor) skipping the network time servers.
In order to activate PTP sync, set machine.time.servers to the PTP device name (e.g. /dev/ptp0):

machine:
  time:
    servers:
      - /dev/ptp0

OpenNebula

Talos Linux now supports OpenNebula platform.

Platforms

Talos Linux now supports Akamai Connected Cloud provider (platform akamai).

Kubernetes API Server Service Account Key

Talos Linux starting from this release uses RSA key for Kubernetes API Server Service Account instead of ECDSA key to provide better compatibility with external OpenID Connect implementations.

SBC

Talos has split the SBC's (Single Board Computers) into separate repositories.
There will not be any more SBC specific release assets as part of Talos release.

The default Talos Installer image will stop working for SBC's and will fail the upgrade, if used, starting from Talos v1.7.0.

The SBC's images and installers can be generated on the fly using Image Factory or using Imager for custom images.
The list of official SBC's images supported by Image Factory can be found in the Overlays repository.

Secure Boot Image

Talos Linux now provides a way to configure systemd-boot ISO 'secure-boot-enroll' option while generating a SecureBoot ISO image:

output:
    kind: iso
    isoOptions:
        sdBootEnrollKeys: force # default is still if-safe
    outFormat: raw

Syslog

Talos Linux now starts a basic syslog receiver listening on /dev/log.
The receiver can mostly parse both RFC3164 and RFC5424 messages and writes them as JSON formatted message.
The logs can be viewed via talosctl logs syslogd.

This is mostly implemented for extension services that log to syslog.

Component Updates

Linux: 6.6.24
etcd: 3.5.11
Kubernetes: 1.30.0-rc.1
containerd: 1.7.14
runc: 1.1.12
Flannel: 0.24.4

Talos is built with Go 1.22.2.

Hardware Watchdog Timers

Talos Linux now supports hardware watchdog timers configuration.
If enabled, and the machine becomes unresponsive, the hardware watchdog will reset the machine.

The watchdog can be enabled with the following configuration document:

apiVersion: v1alpha1
kind: WatchdogTimerConfig
device: /dev/watchdog0
timeout: 3m0s

Contributors

• Andrey Smirnov
• Noel Georgi
• Dmitriy Matrenichev
• Utku Ozdemir
• Andrey Smirnov
• Artem Chernyshev
• Dmitry Sharshakov
• Justin Garrison
• Radosław Piliszek
• Spencer Smith
• Anthony ARNAUD
• Steve Francis
• Anastasios Papagiannis
• Andrei Kvapil
• Andrian Zubovic
• AvnarJakob
• Cas de Reuver
• Christian Mohn
• Christian WALDBILLIG
• Dmitry Sharshakov
• Drew Hess
• Evan Johnson
• ExtraClock
• Fabiano Fidêncio
• Henno Schooljan
• Hervé Werner
• JJGadgets
• Jacob McSwain
• Jean-Tiare Le Bigot
• Jonomir
• Kai Hanssen
• Konrad Eriksson
• Louis SCHNEIDER
• Matthieu S
• Michael Stephenson
• Nico Berlee
• Niklas Wik
• Pip Oomen
• Saiyam Pathak
• Sebastiaan Gerritsen
• Sebastian Gaiser
• Serge Logvinov
• Tim Jones
• bri
• ebcrypto
• edwinavalos
• fazledyn-or
• goodmost
• james-dreebot
• pardomue
• shurkys
• stereobutter

Changes

Changes since v1.7.0-alpha.1

Changes from siderolabs/crypto

Changes from siderolabs/discovery-api

Changes from siderolabs/discovery-client

Changes from siderolabs/extras

Changes from siderolabs/gen

Changes from siderolabs/go-api-signature

Changes from siderolabs/go-copy

Changes from siderolabs/go-debug

Changes from siderolabs/go-kmsg

Changes from siderolabs/go-kubernetes

Changes from siderolabs/go-loadbalancer

Changes from siderolabs/go-talos-support

Changes from siderolabs/pkgs

Changes from siderolabs/siderolink

Changes from siderolabs/tools

Dependency Changes

• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.0 -> v1.11.1
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0 -> v1.5.1
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.0.0 -> v1.1.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.0.1 -> v1.1.0
• github.com/alexflint/go-filemutex v1.3.0 new
• github.com/aws/aws-sdk-go-v2/config v1.25.6 -> v1.27.10
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.5 -> v1.16.1
• github.com/aws/aws-sdk-go-v2/service/kms v1.30.1 new
• github.com/aws/smithy-go v1.17.0 -> v1.20.2
• github.com/beevik/ntp v1.3.0 -> v1.3.1
• github.com/cenkalti/backoff/v4 v4.2.1 -> v4.3.0
• github.com/containerd/cgroups/v3 v3.0.2 -> v3.0.3
• github.com/containerd/containerd v1.7.9 -> v1.7.14
• github.com/containernetworking/plugins v1.3.0 -> v1.4.1
• github.com/coredns/coredns v1.11.2 new
• github.com/cosi-project/runtime v0.3.19 -> v0.4.1
• github.com/distribution/reference v0.5.0 -> v0.6.0
• github.com/docker/docker v24.0.7 -> v26.0.0
• github.com/docker/go-connections v0.4.0 -> v0.5.0
• github.com/foxboron/go-uefi 18b9ba9cd4c3 -> 48be911532c2
• github.com/gdamore/tcell/v2 v2.6.0 -> v2.7.4
• github.com/google/go-containerregistry v0.16.1 -> v0.19.1
• github.com/google/go-tpm v0.9.0 -> ee6cbcd136f8
• github.com/google/nftables v0.1.0 -> v0.2.0
• github.com/google/uuid v1.4.0 -> v1.6.0
• github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 new
• github.com/hetznercloud/hcloud-go/v2 v2.4.0 -> v2.7.0
• github.com/insomniacslk/dhcp b0416c0f187a -> c728f5dd21c8
• github.com/jeromer/syslogparser v1.1.0 new
• github.com/jsimonetti/rtnetlink v1.4.0 -> v1.4.1
• github.com/klauspost/cpuid/v2 v2.2.7 new
• github.com/linode/go-metadata v0.2.0 new
• github.com/mdlayher/kobject 19ca17470d7d new
• github.com/miekg/dns v1.1.58 new
• github.com/opencontainers/image-spec v1.1.0-rc4 -> v1.1.0
• github.com/opencontainers/runtime-spec v1.1.0-rc.1 -> v1.2.0
• github.com/packethost/packngo v0.30.0 -> v0.31.0
• github.com/pmorjan/kmod v1.1.0 -> v1.1.1
• github.com/prometheus/procfs v0.12.0 -> v0.13.0
• github.com/rivo/tview 33a1d271f2b6 -> a22293bda944
• github.com/scaleway/scaleway-sdk-go v1.0.0-beta.21 -> v1.0.0-beta.25
• github.com/siderolabs/crypto v0.4.1 -> v0.4.4
• github.com/siderolabs/discovery-api v0.1.3 -> v0.1.4
• github.com/siderolabs/discovery-client v0.1.5 -> v0.1.8
• github.com/siderolabs/extras v1.6.0-1-g113887a -> v1.7.0-1-gbb76755
• github.com/siderolabs/gen v0.4.7 -> v0.4.8
• github.com/siderolabs/go-api-signature v0.3.2 new
• github.com/siderolabs/go-blockdevice/v2 a5481f5272f2 new
• github.com/siderolabs/go-copy v0.1.0 new
• github.com/siderolabs/go-debug v0.2.3 -> v0.3.0
• github.com/siderolabs/go-kmsg v0.1.3 -> v0.1.4
• github.com/siderolabs/go-kubernetes v0.2.8 -> v0.2.9
• github.com/siderolabs/go-loadbalancer v0.3.2 -> v0.3.3
• github.com/siderolabs/go-talos-support v0.1.0 new
• github.com/siderolabs/pkgs v1.6.0-5-g3ae2450 -> v1.7.0-2-g6101299
• github.com/siderolabs/siderolink v0.3.4 -> v0.3.5
• github.com/siderolabs/talos/pkg/machinery v1.6.0 -> v1.7.0-beta.0
• github.com/siderolabs/tools v1.6.0-1-g336d248 -> v1.7.0-1-g10b2a69
• github.com/stretchr/testify v1.8.4 -> v1.9.0
• github.com/u-root/u-root v0.11.0 -> v0.14.0
• github.com/ulikunitz/xz v0.5.11 -> v0.5.12
• go.etcd.io/etcd/api/v3 v3.5.11 -> v3.5.13
• go.etcd.io/etcd/client/pkg/v3 v3.5.11 -> v3.5.13
• go.etcd.io/etcd/client/v3 v3.5.11 -> v3.5.13
• go.etcd.io/etcd/etcdutl/v3 v3.5.11 -> v3.5.13
• go.uber.org/zap v1.26.0 -> v1.27.0
• go4.org/netipx 6213f710f925 -> fdeea329fbba
• golang.org/x/net v0.19.0 -> v0.23.0
• golang.org/x/oauth2 v0.15.0 -> v0.18.0
• golang.org/x/sync v0.5.0 -> v0.6.0
• golang.org/x/sys v0.15.0 -> v0.18.0
• golang.org/x/term v0.15.0 -> v0.18.0
• google.golang.org/grpc v1.59.0 -> v1.62.1
• google.golang.org/protobuf v1.31.0 -> v1.33.0
• k8s.io/api v0.29.0 -> v0.30.0-rc.1
• k8s.io/apimachinery v0.29.0 -> v0.30.0-rc.1
• k8s.io/apiserver v0.29.0 -> v0.30.0-rc.1
• k8s.io/client-go v0.29.0 -> v0.30.0-rc.1
• k8s.io/component-base v0.29.0 -> v0.30.0-rc.1
• k8s.io/cri-api v0.29.0 -> v0.30.0-rc.1
• k8s.io/klog/v2 v2.110.1 -> v2.120.1
• k8s.io/kube-scheduler v0.29.0 -> v0.30.0-rc.1
• k8s.io/kubectl v0.29.0 -> v0.30.0-rc.1
• k8s.io/kubelet v0.29.0 -> v0.30.0-rc.1
• k8s.io/pod-security-admission v0.30.0-rc.1 new

Previous release can be found at v1.6.0

Images

ghcr.io/siderolabs/flannel:v0.24.4
ghcr.io/siderolabs/install-cni:v1.7.0-1-gbb76755
registry.k8s.io/coredns/coredns:v1.11.1
gcr.io/etcd-development/etcd:v3.5.13
registry.k8s.io/kube-apiserver:v1.30.0-rc.1
registry.k8s.io/kube-controller-manager:v1.30.0-rc.1
registry.k8s.io/kube-scheduler:v1.30.0-rc.1
registry.k8s.io/kube-proxy:v1.30.0-rc.1
ghcr.io/siderolabs/kubelet:v1.30.0-rc.1
ghcr.io/siderolabs/installer:v1.7.0-beta.0
registry.k8s.io/pause:3.8