siderolabs/talos v1.9.0

on GitHub

Talos 1.9.0 (2024-12-17)

Welcome to the v1.9.0 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Auditd

Talos Linux now starts an auditd service by default.
Logs can be read with talosctl logs auditd.

talosctl cgroups

The talosctl cgroups command has been added to the talosctl tool.
This command allows you to view the cgroup resource consumption and limits for a machine, e.g.
talosctl cgroups --preset memory.

cgroups version 1

Support for cgroupsv1 is deprecated, and will be removed in Talos 1.10 (for non-container mode).

Custom search domains for Talos nodes

Talos now allows to supports specifying custom search domains for Talos nodes using
new config field machine.network.searchDomains

For the host it will look something like this:

nameserver 127.0.0.53

search my-custom-search-name.com my-custom-search-name2.com

For the pods it will look something like this:

search default.svc.cluster.local svc.cluster.local cluster.local my-custom-search-name.com my-custom-search-name2.com
nameserver 10.96.0.10
options ndots:5

Device Selectors

Talos now supports matching on permanent hardware (MAC) address of the network interfaces.
This is specifically useful to match bond members, as they change their hardware addresses when they become part of the bond.

Direct Rendering Manager (DRM)

Starting with Talos 1.9, the i915 and amdgpu DRM drivers will be dropped from the Talos squashfs.
There will be new system extensions named i915 and amdgpu that would contain both the drivers and firmware packaged together.
Upgrades via Image Factory will automatically include the new extensions if previously i915-ucode or amdgpu-firmware were used.

Image Cache

Talos now supports providing a local Image Cache for container images.

Kube APIServer Authorization Config

Starting with Talos 1.9, .cluster.apiServer.authorizationConfig field supports setting Kubernetes API server authorization modes
using the --authorization-config flag.

The machine config field supports a list of authorizers. For instance:

cluster:
  apiServer:
    authorizationConfig:
      - type: Node
        name: Node
      - type: RBAC
        name: rbac

For new cluster if the Kubernetes API server supports the --authorization-config flag, it'll be used by default instead of the --authorization-mode flag.
By default Talos will always add the Node and RBAC authorizers to the list.

When upgrading if either a user-provided authorization-mode or authorization-webhook-* flag is set via .cluster.apiServer.extraArgs, it'll be used instead of the new AuthorizationConfig.

Current authorization config can be viewed by running: talosctl get authorizationconfigs.kubernetes.talos.dev -o yaml

Node Address Sort

Talos supports new experimental address sort algorithm for NodeAddress which are used to pick up default addresses for kubelet, etcd, etc.

It can be enabled with the following config patch:

machine:
  features:
    nodeAddressSortAlgorithm: v2

OCI Base Runtime Spec

Talos now allows to modify the OCI base runtime spec for the container runtime.

Registry Mirrors

In versions before Talos 1.9, there was a discrepancy between the way Talos itself and CRI plugin resolves registry mirrors:
Talos will never fall back to the default registry if endpoints are configured, while CRI plugin will.

Note: Talos Linux pulls images for the installer, kubelet, etcd, while all workload images are pulled by the CRI plugin.

In Talos 1.9 this was fixed, so that by default an upstream registry is used as a fallback in all cases, while new registry mirror
configuration option .skipFallback can be used to disable this behavior both for Talos and CRI plugin.

talosctl disks

The command talosctl disks was removed, please use talosctl get disks, talosctl get systemdisk, and talosctl get blockdevices instead.

talosctl wipe

The new command talosctl wipe disk allows to wipe a disk or a partition which is not used as a volume.

udevd

Talos previously used eudev to provide udevd, now it uses systemd-udevd instead.

Component Updates

• Linux: 6.12.5
• containerd: 2.0.1
• Flannel: 0.26.1
• Kubernetes: 1.32.0
• runc: 1.2.3
• CoreDNS: 1.12.0

Talos is built with Go 1.23.4.

User Namespaces

Talos Linux now supports running Kubernetes pods with user namespaces enabled.
Refer to the documentation for more information.

Contributors

• Andrey Smirnov
• Noel Georgi
• Dmitriy Matrenichev
• Dmitry Sharshakov
• Joakim Nohlgård
• Utku Ozdemir
• Jean-Francois Roy
• Nico Berlee
• Steven Kreitzer
• blablu
• Adolfo Ochagavía
• Alessio Moiso
• Christian Luetke-Stetzkamp
• Dan Rue
• David Backeus
• Devin Buhl
• Devin Buhl
• Eddie Wang
• Florian Ströger
• Hexoplon
• Jakob Maležič
• Jasmin
• Justin Garrison
• KBAegis
• KillianCdP
• Mike Beaumont
• Mohammad Amin Mokhtari
• Nebula
• OliviaBarrington
• Philip Schmid
• Philipp Kleber
• Remko Molier
• Robby Ciliberto
• Roman Ivanov
• Ryan Borstelmann
• Rémi Paulmier
• Sam Stelfox
• Serge Logvinov
• Sergey Melnik
• Skyler Mäntysaari
• Spencer Smith
• SpiReCZ
• Steven Cassamajor
• Tim Jones
• Variant9
• adilTepe
• egrosdou01
• ekarlso
• naed3r
• nevermarine
• solidDoWant
• sophia-coldren

Changes

Changes since v1.9.0-beta.1

Changes from siderolabs/crypto

Changes from siderolabs/discovery-api

Changes from siderolabs/discovery-client

Changes from siderolabs/extras

Changes from siderolabs/gen

Changes from siderolabs/go-blockdevice

Changes from siderolabs/go-circular

Changes from siderolabs/go-cmd

Changes from siderolabs/go-kubernetes

Changes from siderolabs/grpc-proxy

Changes from siderolabs/pkgs

Changes from siderolabs/proto-codec

Changes from siderolabs/siderolink

Changes from siderolabs/tools

Dependency Changes

• cloud.google.com/go/compute/metadata v0.5.0 -> v0.5.2
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.13.0 -> v1.16.0
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 -> v1.8.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.1.0 -> v1.3.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 -> v1.3.0
• github.com/aws/aws-sdk-go-v2/config v1.27.33 -> v1.28.5
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.13 -> v1.16.20
• github.com/aws/aws-sdk-go-v2/service/kms v1.35.7 -> v1.37.6
• github.com/aws/smithy-go v1.20.4 -> v1.22.1
• github.com/containerd/cgroups/v3 v3.0.3 -> v3.0.4
• github.com/containerd/containerd/api v1.8.0-rc.3 -> v1.8.0
• github.com/containerd/containerd/v2 v2.0.0-rc.4 -> v2.0.1
• github.com/containerd/errdefs v0.1.0 -> v1.0.0
• github.com/containerd/log v0.1.0 new
• github.com/containerd/platforms v0.2.1 -> v1.0.0-rc.0
• github.com/containerd/typeurl/v2 v2.2.0 -> v2.2.3
• github.com/containernetworking/plugins v1.5.1 -> v1.6.0
• github.com/cosi-project/runtime v0.5.5 -> v0.7.6
• github.com/docker/cli v27.3.1 new
• github.com/docker/docker v27.2.0 -> v27.3.1
• github.com/elastic/go-libaudit/v2 v2.6.1 new
• github.com/fatih/color v1.17.0 -> v1.18.0
• github.com/florianl/go-tc v0.4.4 new
• github.com/foxboron/go-uefi e2076f0e58ca -> fab4fdf2f2f3
• github.com/fsnotify/fsnotify v1.7.0 -> v1.8.0
• github.com/google/cadvisor v0.50.0 -> v0.51.0
• github.com/google/cel-go v0.22.1 new
• github.com/gopacket/gopacket v1.2.0 -> v1.3.1
• github.com/hetznercloud/hcloud-go/v2 v2.13.1 -> v2.17.0
• github.com/jsimonetti/rtnetlink/v2 v2.0.2 -> 2d6e9f8ad3f2
• github.com/klauspost/compress v1.17.9 -> v1.17.11
• github.com/klauspost/cpuid/v2 v2.2.8 -> v2.2.9
• github.com/linode/go-metadata v0.2.0 -> v0.2.1
• github.com/mdlayher/ethtool v0.1.0 -> v0.2.0
• github.com/opencontainers/runc v1.2.0-rc.3 -> v1.2.2
• github.com/rivo/tview fd649dbf1223 -> c76f7879f592
• github.com/safchain/ethtool v0.4.1 -> v0.5.9
• github.com/siderolabs/crypto v0.4.4 -> v0.5.0
• github.com/siderolabs/discovery-api v0.1.4 -> v0.1.5
• github.com/siderolabs/discovery-client v0.1.9 -> v0.1.10
• github.com/siderolabs/extras v1.8.0 -> v1.9.0
• github.com/siderolabs/gen v0.5.0 -> v0.7.0
• github.com/siderolabs/go-blockdevice v0.4.7 -> v0.4.8
• github.com/siderolabs/go-blockdevice/v2 v2.0.2 -> v2.0.7
• github.com/siderolabs/go-circular v0.2.0 -> v0.2.1
• github.com/siderolabs/go-cmd v0.1.1 -> v0.1.3
• github.com/siderolabs/go-kubernetes v0.2.12 -> v0.2.17
• github.com/siderolabs/grpc-proxy v0.4.1 -> v0.5.1
• github.com/siderolabs/pkgs v1.8.0-8-gdf1a1a5 -> v1.9.0-12-g9576b97
• github.com/siderolabs/proto-codec v0.1.1 new
• github.com/siderolabs/siderolink v0.3.10 -> v0.3.11
• github.com/siderolabs/talos/pkg/machinery v1.8.0 -> v1.9.0
• github.com/siderolabs/tools v1.8.0-1-ga0c06c6 -> v1.9.0-1-geaad82f
• github.com/sirupsen/logrus v1.9.3 new
• github.com/stretchr/testify v1.9.0 -> v1.10.0
• github.com/thejerf/suture/v4 v4.0.5 new
• go.etcd.io/etcd/api/v3 v3.5.16 -> v3.5.17
• go.etcd.io/etcd/client/pkg/v3 v3.5.16 -> v3.5.17
• go.etcd.io/etcd/client/v3 v3.5.16 -> v3.5.17
• go.etcd.io/etcd/etcdutl/v3 v3.5.16 -> v3.5.17
• golang.org/x/net v0.29.0 -> v0.32.0
• golang.org/x/oauth2 v0.23.0 -> v0.24.0
• golang.org/x/sync v0.8.0 -> v0.10.0
• golang.org/x/sys v0.25.0 -> v0.28.0
• golang.org/x/term v0.24.0 -> v0.27.0
• golang.org/x/text v0.18.0 -> v0.21.0
• golang.org/x/time v0.6.0 -> v0.8.0
• google.golang.org/grpc v1.66.0 -> v1.68.1
• google.golang.org/protobuf v1.34.2 -> v1.35.2
• k8s.io/api v0.31.1 -> v0.32.0
• k8s.io/apimachinery v0.31.1 -> v0.32.0
• k8s.io/apiserver v0.31.1 -> v0.32.0
• k8s.io/client-go v0.31.1 -> v0.32.0
• k8s.io/component-base v0.31.1 -> v0.32.0
• k8s.io/cri-api v0.32.0-alpha.0 -> v0.32.0
• k8s.io/kube-scheduler v0.31.1 -> v0.32.0
• k8s.io/kubectl v0.31.1 -> v0.32.0
• k8s.io/kubelet v0.31.1 -> v0.32.0
• k8s.io/pod-security-admission v0.31.1 -> v0.32.0
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.70 -> v1.2.72

Previous release can be found at v1.8.0

Images

ghcr.io/siderolabs/flannel:v0.26.1
registry.k8s.io/coredns/coredns:v1.12.0
gcr.io/etcd-development/etcd:v3.5.17
registry.k8s.io/kube-apiserver:v1.32.0
registry.k8s.io/kube-controller-manager:v1.32.0
registry.k8s.io/kube-scheduler:v1.32.0
registry.k8s.io/kube-proxy:v1.32.0
ghcr.io/siderolabs/kubelet:v1.32.0
ghcr.io/siderolabs/installer:v1.9.0
registry.k8s.io/pause:3.10