siderolabs/talos v1.9.0-alpha.3

on GitHub

Talos 1.9.0-alpha.3 (2024-11-25)

Welcome to the v1.9.0-alpha.3 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

AppArmor

Talos Linux starting with v1.9 will ship with SELinux LSM enabled by default.
If you need to use AppArmor LSM add the following to the machine configuration:

machine:
  install:
     extraKernelArgs:
      - -selinux
      - lsm=lockdown,capability,yama,apparmor,bpf
      - apparmor=1

Auditd

Talos Linux now starts a auditd service by default.
Logs can be read with talosctl logs auditd.

talosctl cgroups

The talosctl cgroups command has been added to the talosctl tool.
This command allows you to view the cgroup resource consumption and limits for a machine, e.g.
talosctl cgroups --preset memory.

Device Selectors

Talos now supports matching on permanent hardware (MAC) address of the network interfaces.
This is specifically useful to match bond members, as they change their hardware addresses when they become part of the bond.

Direct Rendering Manager (DRM)

Starting with Talos 1.9, the i915 and amdgpu DRM drivers will be dropped from the Talos squashfs.
There will be new system extensions named i915 and amdgpu that would contain both the drivers and firmware packaged together.
Upgrades via Image Factory will automatically include the new extensions if previously i915-ucode or amdgpu-firmware were used.

Registry Mirrors

In versions before Talos 1.9, there was a discrepancy between the way Talos itself and CRI plugin resolves registry mirrors:
Talos will never fall back to the default registry if endpoints are configured, while CRI plugin will.

Note: Talos Linux pulls images for the installer, kubelet, etcd, while all workload images are pulled by the CRI plugin.

In Talos 1.9 this was fixed, so that by default an upstream registry is used as a fallback in all cases, while new registry mirror
configuration option .skipFallback can be used to disable this behavior both for Talos and CRI plugin.

talosctl disks

The command talosctl disks was removed, please use talosctl get disks, talosctl get systemdisk, and talosctl get blockdevices instead.

talosctl wipe

The new command talosctl wipe disk allows to wipe a disk or a partition which is not used as a volume.

udevd

Talos previously used eudev to provide udevd, now it uses systemd-udevd instead.

Component Updates

• Linux: 6.6.60
• containerd: 2.0.0
• Flannel: 0.26.0
• Kubernetes: 1.32.0-beta.0
• runc: 1.2.1

Talos is built with Go 1.23.3.

User Namespaces

Talos Linux now supports running Kubernetes pods with user namespaces enabled.
Refer to the documentation for more information.

Contributors

• Andrey Smirnov
• Noel Georgi
• Dmitry Sharshakov
• Dmitriy Matrenichev
• Joakim Nohlgård
• Jean-Francois Roy
• Utku Ozdemir
• blablu
• Adolfo Ochagavía
• Alessio Moiso
• Dan Rue
• David Backeus
• Eddie Wang
• Florian Ströger
• Hexoplon
• Jakob Maležič
• KBAegis
• Mike Beaumont
• Nebula
• Nico Berlee
• OliviaBarrington
• Philip Schmid
• Philipp Kleber
• Remko Molier
• Robby Ciliberto
• Roman Ivanov
• Ryan Borstelmann
• Sam Stelfox
• Serge Logvinov
• Sergey Melnik
• Spencer Smith
• SpiReCZ
• Steven Cassamajor
• Steven Kreitzer
• Tim Jones
• Variant9
• adilTepe
• ekarlso
• naed3r
• nevermarine
• solidDoWant
• sophia-coldren

Changes

Changes since v1.9.0-alpha.2

Changes from siderolabs/crypto

Changes from siderolabs/discovery-api

Changes from siderolabs/discovery-client

Changes from siderolabs/extras

Changes from siderolabs/gen

Changes from siderolabs/go-blockdevice

Changes from siderolabs/go-circular

Changes from siderolabs/go-cmd

Changes from siderolabs/go-kubernetes

Changes from siderolabs/grpc-proxy

Changes from siderolabs/pkgs

Changes from siderolabs/proto-codec

Changes from siderolabs/siderolink

Changes from siderolabs/tools

Dependency Changes

• cloud.google.com/go/compute/metadata v0.5.0 -> v0.5.2
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.13.0 -> v1.16.0
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 -> v1.8.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.1.0 -> v1.3.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.1.0 -> v1.3.0
• github.com/aws/aws-sdk-go-v2/config v1.27.33 -> v1.28.3
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.13 -> v1.16.19
• github.com/aws/aws-sdk-go-v2/service/kms v1.35.7 -> v1.37.5
• github.com/aws/smithy-go v1.20.4 -> v1.22.0
• github.com/containerd/containerd/api v1.8.0-rc.3 -> v1.8.0
• github.com/containerd/containerd/v2 v2.0.0-rc.4 -> v2.0.0
• github.com/containerd/errdefs v0.1.0 -> v1.0.0
• github.com/containerd/platforms v0.2.1 -> v1.0.0-rc.0
• github.com/containerd/typeurl/v2 v2.2.0 -> v2.2.3
• github.com/containernetworking/plugins v1.5.1 -> v1.6.0
• github.com/cosi-project/runtime v0.5.5 -> v0.7.1
• github.com/docker/cli v27.3.1 new
• github.com/docker/docker v27.2.0 -> v27.3.1
• github.com/elastic/go-libaudit/v2 v2.6.0 new
• github.com/fatih/color v1.17.0 -> v1.18.0
• github.com/florianl/go-tc v0.4.4 new
• github.com/foxboron/go-uefi e2076f0e58ca -> fab4fdf2f2f3
• github.com/fsnotify/fsnotify v1.7.0 -> v1.8.0
• github.com/google/cadvisor v0.50.0 -> v0.51.0
• github.com/google/cel-go v0.22.0 new
• github.com/gopacket/gopacket v1.2.0 -> v1.3.1
• github.com/hetznercloud/hcloud-go/v2 v2.13.1 -> v2.16.0
• github.com/klauspost/compress v1.17.9 -> v1.17.11
• github.com/klauspost/cpuid/v2 v2.2.8 -> v2.2.9
• github.com/linode/go-metadata v0.2.0 -> v0.2.1
• github.com/mdlayher/ethtool v0.1.0 -> v0.2.0
• github.com/opencontainers/runc v1.2.0-rc.3 -> v1.2.1
• github.com/rivo/tview fd649dbf1223 -> c76f7879f592
• github.com/safchain/ethtool v0.4.1 -> 4e3aff457298
• github.com/siderolabs/crypto v0.4.4 -> v0.5.0
• github.com/siderolabs/discovery-api v0.1.4 -> v0.1.5
• github.com/siderolabs/discovery-client v0.1.9 -> v0.1.10
• github.com/siderolabs/extras v1.8.0 -> v1.9.0-alpha.0-2-g78ba66b
• github.com/siderolabs/gen v0.5.0 -> v0.7.0
• github.com/siderolabs/go-blockdevice v0.4.7 -> v0.4.8
• github.com/siderolabs/go-blockdevice/v2 v2.0.2 -> v2.0.6
• github.com/siderolabs/go-circular v0.2.0 -> v0.2.1
• github.com/siderolabs/go-cmd v0.1.1 -> v0.1.3
• github.com/siderolabs/go-kubernetes v0.2.12 -> v0.2.16
• github.com/siderolabs/grpc-proxy v0.4.1 -> v0.5.1
• github.com/siderolabs/pkgs v1.8.0-8-gdf1a1a5 -> v1.9.0-alpha.0-45-ga463a50
• github.com/siderolabs/proto-codec v0.1.1 new
• github.com/siderolabs/siderolink v0.3.10 -> v0.3.11
• github.com/siderolabs/talos/pkg/machinery v1.8.0 -> v1.9.0-alpha.3
• github.com/siderolabs/tools v1.8.0-1-ga0c06c6 -> v1.9.0-alpha.0-9-ge061b6f
• github.com/thejerf/suture/v4 v4.0.5 new
• go.etcd.io/etcd/api/v3 v3.5.16 -> v3.5.17
• go.etcd.io/etcd/client/pkg/v3 v3.5.16 -> v3.5.17
• go.etcd.io/etcd/client/v3 v3.5.16 -> v3.5.17
• go.etcd.io/etcd/etcdutl/v3 v3.5.16 -> v3.5.17
• golang.org/x/net v0.29.0 -> v0.31.0
• golang.org/x/oauth2 v0.23.0 -> v0.24.0
• golang.org/x/sync v0.8.0 -> v0.9.0
• golang.org/x/sys v0.25.0 -> v0.27.0
• golang.org/x/term v0.24.0 -> v0.26.0
• golang.org/x/text v0.18.0 -> v0.20.0
• golang.org/x/time v0.6.0 -> v0.8.0
• google.golang.org/grpc v1.66.0 -> v1.68.0
• google.golang.org/protobuf v1.34.2 -> v1.35.1
• k8s.io/api v0.31.1 -> v0.32.0-beta.0
• k8s.io/apimachinery v0.31.1 -> v0.32.0-beta.0
• k8s.io/apiserver v0.31.1 -> v0.32.0-beta.0
• k8s.io/client-go v0.31.1 -> v0.32.0-beta.0
• k8s.io/component-base v0.31.1 -> v0.32.0-beta.0
• k8s.io/cri-api v0.32.0-alpha.0 -> v0.32.0-beta.0
• k8s.io/kube-scheduler v0.31.1 -> v0.32.0-beta.0
• k8s.io/kubectl v0.31.1 -> v0.32.0-beta.0
• k8s.io/kubelet v0.31.1 -> v0.32.0-beta.0
• k8s.io/pod-security-admission v0.31.1 -> v0.32.0-beta.0
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.70 -> v1.2.72

Previous release can be found at v1.8.0

Images

ghcr.io/siderolabs/flannel:v0.26.0
registry.k8s.io/coredns/coredns:v1.11.3
gcr.io/etcd-development/etcd:v3.5.17
registry.k8s.io/kube-apiserver:v1.32.0-beta.0
registry.k8s.io/kube-controller-manager:v1.32.0-beta.0
registry.k8s.io/kube-scheduler:v1.32.0-beta.0
registry.k8s.io/kube-proxy:v1.32.0-beta.0
ghcr.io/siderolabs/kubelet:v1.32.0-beta.0
ghcr.io/siderolabs/installer:v1.9.0-alpha.3
registry.k8s.io/pause:3.10