Go modules · #305 by repository stars

github.com/siderolabs/talos

v1.14.2siderolabs/talos ↗New releases in your daily digest, changelog included.

Last release today
01 Oct 2026
Ships on a steady schedule
a new release about every 8 days
Some releases are documented
notes for 17 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
8 years old
3045 releases · first in 2018

Release timeline

3045 releases since 2018

2018202020222024

Releases

v1.13.0-alpha.2.0.20260326091927-b3dfbf743e6c26 Mar 2026pre-release
Nothing published for this version
v1.13.0-alpha.2.0.20260326063154-f2bc2dcc6e0326 Mar 2026pre-release
Nothing published for this version
v1.13.0-alpha.2.0.20260325091711-aa5946dd385a25 Mar 2026pre-release
Nothing published for this version
v1.13.0-alpha.2.0.20260325073144-1dd701efa811

v1.13.0-alpha.225 Feb 2026pre-releaseDeprecated2 sources agree

…variables for Talos components. It replaces and deprecates the previous method of setting environment variables via the .machine.env field.

Welcome to the v1.13.0-alpha.2 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Clang built kernel and ThinLTO

Talos now uses a kernel built using Clang compiler, and optimized using ThinLTO. This should bring a small performance improvement, alongside some hardening features, such as BTI on supported ARM systems.

talosctl debug

Talos Linux now provides a way to run and attach to the privileged debug container with a user-provided container image. The debug container might be used for troubleshooting and debugging purposes.

Environment Configuration Document

A new EnvironmentConfig document has been introduced to allow users to specify environment variables for Talos components. It replaces and deprecates the previous method of setting environment variables via the .machine.env field.

Multiple values for the same environment variable will replace previous values, with the last one taking precedence.

To remove an environment variable, remove it from the EnvironmentConfig document and restart the node.

External Volumes

Talos now supports virtiofs-based external volumes via the new ExternalVolumeConfig document.

These virtiofs external volumes are not supported when SELinux is running in enforcing mode.

Extra Arguments accept slices in addition to strings

Several Talos configuration fields that previously accepted single string values for extra arguments have been updated to accept slices of strings as well. This includes fields such as .cluster.apiServer.extraArgs.

BREAKING: If you were relying on the resources EtcdConfigs, KubeletConfigs, ControllerManagerConfigs, SchedulerConfigs or APIServerConfigs, the protobuf format has changed from map<string,string> to map<string,message>.

Talos Imager Enhancements

Talos imager now supports running rootless. --privileged and -v /dev:/dev are no longer required.

Image APIs Updated

Talos Linux provides new APIs to manage container images on the node: listing, pulling, importing and removing images. The new pull APIs provides pull progress notifications.

The CLI commands talosctl image pull, talosctl image list and talosctl image remove have been updated to interact with the new APIs.

Talosctl images k8s-bundle subcommand accepts version parameter

The talosctl images k8s-bundle command now accepts an optional version overrides arguments.

Kubernetes server-side apply

Talos now uses inventory backed server-side apply when applying bootsrap manifests (including extraManifests and inlineManifests). Purging of unneeded manifests is automatically performed. The switch and inventory backfill is automatic and no action is needed from the user.

KubeSpan Configuration

A new KubeSpanConfig document has been introduced to configure KubeSpan settings. It replaces and deprecates the previous method of configuring KubeSpan via the .machine.network.kubespan field.

The old configuration field will continue to work for backward compatibility.

KubeSpan Advertised Network Filters

KubeSpan now supports filtering of advertised networks using the excludeAdvertisedNetworks field in the KubeSpanConfig document. This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers, and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.

LinkAliasConfig Pattern-Based Multi-Alias

LinkAliasConfig now supports pattern-based alias names using %d format verb (e.g. net%d).

When the alias name contains a %d format verb, the selector is allowed to match multiple links. Each matched link receives a sequential alias (e.g. net0, net1, ...) based on hardware address order of the links. Links already aliased by a previous config are automatically skipped.

This enables creating stable aliases from any N links using a single config document, useful for BondConfig and BridgeConfig member interfaces on varying hardware.

Negative Max Volume Size

Negative max size represents the amount of space to be left free on the device, rather than the size the volume should consume. For example: * a max size of "-10GiB" means the volume can grow to the available space minus 10GiB. * a max size of "-25%" means the volume can grow to the available space minus 25%.

Flannel CNI with Network Policy Support

Talos Linux now supports optionally deploying Flannel CNI with network policy support enabled. The network policy implementation is kube-network-policies.

To enable Flannel CNI with network policy support, use the following machine configuration patch:

cluster:
  network:
    cni:
      name: flannel
      flannel:
        kubeNetworkPoliciesEnabled: true

(If the cluster is already running, sync the bootstrap manifests after applying the patch to deploy the new CNI configuration.)

Container Image Decompression

Talos now ships with igzip (amd64) and pigz (arm64) to speed up container image decompression.

ProbeConfig

The TCPProbeConfig configuration document allows to configure TCP probes for network reachability checks. This allows to define a custom connectivity condition.

/proc/PID/mem Access Hardening

A new kernel parameter proc_mem.force_override=never has been introduced by default to enhance system security by preventing unwanted writes to protected process memory via /proc/PID/mem. If the kernel parameter is removed, default behavior is restored, allowing access only if the process is traced.

Reproducible Disk Images

Talos disk images are now reproducible. Building the same version of Talos multiple times will yield identical disk images.

Note: VHD and VMDK (Azure and VMware) images are not currently reproducible due to limitations in the underlying image creation tools. Users verifying reproducible images should use raw images, verify checksums, and convert them to VHD/VMDK as needed.

ResolverConfig

The nameservers configuration in machine configuration now overwrites any previous layers (defaults, platform, etc.) when specified. Previously a smart merge was performed to keep IPv4/IPv6 nameservers from lower layers if the machine configuration specified only one type.

Service Account Issuer configuration

In API Server, passing extra args with service-account-issuer will append them after default value. This allows easy migration, e.g. by changing .cluster.controlPlane.endpoint to new value, and keeping the old value in .cluster.apiServer.extraArgs["service-account-issuer"].

`talosctl images talos-bundle` can ignore reaching to the registry

The talosctl images talos-bundle command now accepts optional --overlays and --extensions flags. If those are set to false, the command will not attempt to reach out to the container registry to fetch the latest versions and digests of the overlays and extensions.

Component Updates

Linux: 6.18.13 containerd: 2.2.1 etcd: 3.6.8 CoreDNS: 1.14.1 Kubernetes: 1.36.0-alpha.1 Flannel CNI plugin: v1.9.0-flannel1 Flannel: 0.28.1 LVM2: 2_03_38 runc: 1.4.0 systemd: 259.1 cryptsetup: 2.8.3 Tenstorrent: 2.7.0 iptables: 1.8.12

Talos is built with Go 1.26.0.

VM Hot-Add Support

Talos now includes udev rules to support hot-adding of CPUs in virtualized environments.

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi
Dmitrii Sharshakov
Orzelius
Laura Brehm
Edward Sammut Alessi
Max Makarov
Andreas Freund
Artem Chernyshev
Bryan Lee
Fritz Schaal
Justin Garrison
Mickaël Canévet
Nico Berlee
Pranav Patil
Alexis La Goutte
Andras BALI
Andrei Kvapil
Birger Johan Nordølum
Camillo Rossi
Christopher Puschmann
Daniil Kivenko
Dmitrii Sharshakov
Florian Ströger
Gregor Gruener
Jaakko Sirén
Jan Paul
Jean-Francois Roy
Joakim Nohlgård
Jonas Lammler
Lennard Klein
Matthew Sanabria
Michal Baumgartner
Olav Thoresen
Serge van Ginderachter
Skye Soss
Spencer Smith
Sébastien Masset
Tim Jones
Utku Ozdemir
arita
dataprolet
drew
eseiker
greenpsi
lmacka
pranav767

Changes

<details><summary>221 commits</summary>

009f0d6ca chore: update pkgs
ba56b0295 feat: include hid-multitouch.ko kernel module in rootfs
ae29a0dcc feat: update Linux to 6.18.13
7cf1de279 fix: bring in new version of go-cmd and go-blockdevice
c8800b41e fix: update path handling on talosctl cgroups
0a7b6eb2c chore: test extensions
8b1c974a2 refactor: drop termui-widgets library
5baa0028e fix: add owning inventory annotation to talos manifests
d3e793d14 fix: stop Kubernetes client from dynamically reloading the certs
6a5a0e3bd feat: support pattern link aliases
9758bd4fe feat: update Go to 1.26
e00aed0f6 feat: update Kubernetes v1.36.0-alpha.1
f20445ad0 chore: improve logging of disk encryption handling
f018fbe7b fix: handle raw encryption keys with \n properly
e5b0eb017 fix: hold user volumes root mountpoint
8a0e79774 refactor: split locate and provision
a59db0e92 fix: improve OpenStack bare metal network configuration reliability
659009ad8 fix: remove stale endpoints
dab0d4783 fix: allow static hosts in /etc/hosts without hostname
45f214154 feat: update go-kubernetes to use new Myers diff
35ad0448c fix: switch to better Myers algorithm implementation
0048464be feat: update etcd to v3.6.8
5df10f260 fix: use mcopy instead of diskfs to populate VFAT
ce53ffa90 fix: disks flag parsing and handling in create qemu command
3bd3dd7ca fix: memory overuse in imager VFAT
f118ee47e fix: read multi-doc machine config with newer talosctl
70c6c2154 feat: add filter for KubeSpan advertised networks
daf18abf4 fix: fix talosctl debug in enforcing mode
33b5b2565 fix: ignore volumes in wave calculation without provisioning
a16392559 feat: add explicit service account support to Talos client
4d531884e chore: update dependencies
406b8c83c feat: update doc links to docs.siderolabs.com
87615f551 feat: implement network policies with Flannel CNI
6995bc1b1 chore: update homebrew formula on release
7942d5a98 fix: image gc controller config
52e8727d0 feat: add IPv6 GRE support
9690dbad0 chore: bump tools (including linter)
2628eb2ec fix: typo with rpi_5 profile name
d5ebcd7ca fix: stop building talosctl debug on Windows
8b85c7c63 chore: update deps
d905035b5 fix: swap volume configuration for min/max size
d43a01ccb feat: implement talosctl debug
34a31c979 feat: add mount options support for existing volumes
1bf95eed1 feat: improve dashboard uptime display
055add7ae release(v1.13.0-alpha.1): prepare release
900516e68 chore: update image signer
938de566e feat: bump kernel
388cec727 feat(overlays): add new overlays
9f2dd6312 refactor: api tests
a90783146 feat: add a helper module to generate standard patches
1fec5b23d fix: implement merger for PercentageSize
8b245b8f2 feat: implement new image service APIs
d90c775b8 chore: rename internal talosctl debug air-gapped
2165280d0 refactor: change the way one2many proxying is picked
b1b703dbe chore: move sync logging code to go-kubernetes package
e48c6d7ab fix: allow to expose a port multiple times in Docker
410d8cb57 fix: undo CRLF on Windows (talosctl edit)
859d3f03c feat: add RPi5 to the list of supported SBCs
0bd48bbc6 fix(talosctl): pass --k8s-endpoint flag to rotate-ca kubernetes rotation
b9e27ebe7 feat: update Linux kernel with dm-integrity
6aa9b0677 fix: skip empty documents on config decoding
494492489 fix: always set advertised peer URLs
782cc507d fix: open the filesystem as read-only
28e61a740 fix: set GRUB prefix correctly on arm64
a4f1c5239 feat: update GRUB to 2.14
562920701 fix: use node podCIDRs for kubespan advertiseKubernetesNetworks
39460365c feat: implement layering for ProbeSpec
b5c760f70 feat: add ProbeConfig for network connectivity probes
4b274f761 feat: support aws cert manager in imager
417209512 fix: fallback to /proc/meminfo for memory modules
7f1147bed fix: add warnings to 802.3ad bond
ddd6b186e refactor: generate GRUB images
c7aa266ea fix: overwrite resolver config with machine config
cf70f05fa fix: oracle platform file format
8c7b8f5b7 feat: add support for negative max size
77bc3d21f fix: marshal of FailOverMac property
38e280c93 fix: make OOM expression a bit less sensitive
3d1301640 fix: wipe the first/last 1MiB in addition to wiping by signatures
1aa6528ad fix: make OOM controller more precise by considering separate cgroup PSI
f7072c050 fix: check if the device is not mounted when wiping
743c3b94b fix: use correct containerd import path
f2dd08594 feat: report image pull progress in the console
72fe98a06 fix: boot with GRUB
d4ed13d93 fix: add talos version to Hetzner Cloud client user agent
150c41c30 feat: update Linux to 6.18.5
01a367891 fix: use append instead of prepend in service-account-issuer
d1954278a feat: add extraArgs from service-account-issuer
91b88f7f9 feat: support multiple values for extraArgs
96e604874 fix: add hostname to endpoints
7033275a7 refactor: move BootloaderKind into machinery
71adaf0ea fix: sort mirrors and tls configs when generating the machine config
34f09a300 feat: add VLAN support to OpenStack platform
5127ef7c2 fix: wipe disk by signatures
415bfaedb fix: panic in configpatcher when the whole section is missing
e5aca71cd fix: fix healthcheck timeout
634b71e2d docs: move talosctl pcap example to Example Block
818492731 feat: implement KubeSpan multi-document configuration
4d0604b9d chore: remove unrelated machineconfig
e36863470 feat: add it87 hwmon module
308c75090 fix: resolve SideroLink Wireguard endpoint on reconnect
e4ef494de fix: drop the persist config flag from gen config
c3176adcf feat: add EnvironmentConfig document
c839b3880 feat: expose more SSA options in the upgrade-k8s command
b8ff9677e fix: handle correctly incomplete RegistryTLSConfig
99f2ddada fix: bond config via platform
2449ffea4 fix: allow HostnameConfig to be used with incomplete machine config
35fc52087 fix: lock down etcd listen address to IPv4 localhost
27253d731 feat: use new xfs config file
c9d84ae21 fix: generate OCI-compliant image config
7a4b2b33a fix: update VIP config example
080efcbda feat: add k8s-version parameter to k8s-bundle
b764f5f72 fix: skip sync test when kube-proxy is disabled
70e67787d feat: imager: populate filesystems with root owned files
7416dca59 fix: print talosctl images to release notes
dc2009e47 chore: use context when creating filesystems
85f7be6e3 chore: update slack links
154952175 fix: disable swap for system services
d98b415af fix: drop more non-overlay SBC stuff
226cd6bc1 fix: do not allocate for the actual disk image file
53f5bf8d2 fix: overlay installers
10d0cfd93 fix: overlay install in image mode
77086694d fix: partition data population
4d5657b1a fix: drop SBC board code
c4f3f6d3e feat: implement kubernetes server-side apply
f12fd2b0a test: bump Image Factory tests
c76484e58 release(v1.13.0-alpha.0): prepare release
f0d8a6851 test: skip the source bundle on exact tag
c57701d65 fix: remove interactive installer
43937c1cd feat: update Linux and systemd
72a194df8 feat: add VM CPU hot-add rules
f09ae1e0d fix: probe small images correctly
8f2b33799 feat: imager support rootless builds
c7525a97e feat: support creating filesystems from folder
e2bffb5ce chore: refactor imager code so it's more clear
0fb50dbd0 fix: invalid versions check in talos-bundle
b5dd56032 test: upgrade versions in upgrade tests
3dfa4d6e4 fix: make upgrade work with SELinux enforcing=1
786c8e2ee feat: ship pigz/igzip in rootfs to speed up image decompression
48d242918 feat: update containerd to 2.2.1
536541afe fix: mount volume mount/unmount race
39117d457 feat: update dependencies
f0f420725 fix: bond setting change detection
8d6a7a867 feat: update Kubernetes to 1.35.0
845a0d09c feat: update etcd 3.6.7, CoreDNS 1.13.2
b95912e04 feat: enforce proc_mem.force_override=never by default
681f3e84c test: run virtiofs tests only when virtiofsd is running
0592ff0cd fix: drop the Omni API URL check on IP address
a4879a5fa feat: update Linux to 6.18.1
43b43ff18 docs: split talosctl commands into groups
6d17c18bf feat: enable Powercap and Intel RAPL
884e76662 docs: fix the talosctl cluster create help output
6dc31be4f fix: exclude new Virtual IPs configured with new config
94905c73e feat(talosctl): support running qemu x86 on Mac
f871ab241 fix: provide json support in nft binary
694f45413 feat: external volumes
39feb16d2 fix: update containerd 2.2.0 with cgroups patch
82027eb9b fix: bond configuration with new settings
121b13b8f fix: disable kexec on arm64
7eaa725d0 fix: selection of boot entry
949bdb90a feat: add Secure Boot to CloudStack platform config
798143a88 fix: discard better klog message from Kubernetes client
008cd0986 fix: disable kexec in talosctl cluster create on arm64
bb62b29ed chore: prepare talos for 1.13
c0935030a chore: fork reference docs for 1.13.x
e387e48b3 fix: do not override DNS on MacOS
1e7e87fb1 fix: rework NFT rules for KubeSpan
51bcfb567 feat: rename image default and source bundle
585abe944 feat: update Kubernetes to v1.35.0-rc.1
f301e3e9b fix: update KubeSpan MSS clamping
74c1df6f4 test: propagate MTU size to QEMU in talosctl cluster create
d347ca1af fix: update CNI plugins to 1.9.0
e3f8196b4 chore: update Grype and Syft
e1b8ab323 docs: add misssing period
cd04c3dde docs: update release notes
fc8ae3249 docs: add omni join token example to create qemu command
9fa00773c chore: update go-blockdevice
ba13b6786 fix: correct condition to use UKI cmdline in GRUB
d2ce3f47f docs: drop machine.network example
cf087c1e0 test: bird2 extension
13df94388 fix: adapt SELinuxSuite.TestNoPtrace to new strace version
861787c38 fix: mark secureboot as supported for metal
04e3e87ad fix: clean up kubelet mounts
21057903a fix: clear provisioning data on SideroLink config change
0f9f4c05f feat: update Kubernetes to 1.35.0-rc.0
d4309d7b1 fix: add a timeout for DNS resolving for NTP
dd6c1089c feat: update Linux to 6.18.0
e9a30bf9a test: revert add direct connectivity CA rotation test
cc95562bc fix: don't disable LACP by default
c9fe4679b test: add platform acquire/not valid config unit-test
5a03a7a20 chore: fix longhorn test
a0cfc3527 feat: implement logs persistence
51b732bea fix: selection of boot entry
18f8ac369 feat: update Kubernetes to 1.35.0-beta.0
92fa7c5e4 chore: update pkgs for NVIDIA 580.105.08
f489299b6 chore: correct condition for running k8s integration tests
ab149750d chore: update tools/pkgs to 1.13.0-alpha.0
87ff9f860 test: fix the image-factory test to pass IF endpoint
2ffe538e7 test: add direct connectivity CA rotation test
70f6b80e0 chore(ci): skip multipath extension tests
561cfb60c chore: update pkgs and tools version
2f42202a7 fix: simplify OOM expression
7b06ae8c2 test: fix flaky LinkSpec/Wireguard test
e715f3871 feat: present kernel log as talosctl logs kernel
e2ee39b8a fix: support specifying patch file without '@' symbol
e202b1f9e fix: trim trailing dots from certificate SANs
7f7079f9c fix: assign value of multicast setting properly
eba96141e feat: update etcd to 3.6.6
9945ceef3 docs: add API Server Cipher Suites changelog
9ed488d09 feat: update TLS cipher suites for API server
f1c04e4d6 feat: generate mirrors patch
a89108995 fix: add CA subject to generated certificate
35dd612a5 fix: add more resilient move
83675838f feat: extend flags of cache-cert-gen
80ab7a064 chore: remove spammy 'clean up unused volumes' logs
74d35900a chore: disable k8s integration tests for 1GiB worker nodes
4f6218674 feat: support TALOS_HOME env var
0c59b3ea3 feat: add multicast to linkconfig
6db06f4d5 feat: implement multicast setting
eeded98f5 fix: add riscv64 talosctl to release artifacts
a6bbae91b fix: fix typos across the project
83f2bdb9c feat: support relative voume size </details>

Changes since v1.13.0-alpha.1

<details><summary>44 commits</summary>

009f0d6ca chore: update pkgs
ba56b0295 feat: include hid-multitouch.ko kernel module in rootfs
ae29a0dcc feat: update Linux to 6.18.13
7cf1de279 fix: bring in new version of go-cmd and go-blockdevice
c8800b41e fix: update path handling on talosctl cgroups
0a7b6eb2c chore: test extensions
8b1c974a2 refactor: drop termui-widgets library
5baa0028e fix: add owning inventory annotation to talos manifests
d3e793d14 fix: stop Kubernetes client from dynamically reloading the certs
6a5a0e3bd feat: support pattern link aliases
9758bd4fe feat: update Go to 1.26
e00aed0f6 feat: update Kubernetes v1.36.0-alpha.1
f20445ad0 chore: improve logging of disk encryption handling
f018fbe7b fix: handle raw encryption keys with \n properly
e5b0eb017 fix: hold user volumes root mountpoint
8a0e79774 refactor: split locate and provision
a59db0e92 fix: improve OpenStack bare metal network configuration reliability
659009ad8 fix: remove stale endpoints
dab0d4783 fix: allow static hosts in /etc/hosts without hostname
45f214154 feat: update go-kubernetes to use new Myers diff
35ad0448c fix: switch to better Myers algorithm implementation
0048464be feat: update etcd to v3.6.8
5df10f260 fix: use mcopy instead of diskfs to populate VFAT
ce53ffa90 fix: disks flag parsing and handling in create qemu command
3bd3dd7ca fix: memory overuse in imager VFAT
f118ee47e fix: read multi-doc machine config with newer talosctl
70c6c2154 feat: add filter for KubeSpan advertised networks
daf18abf4 fix: fix talosctl debug in enforcing mode
33b5b2565 fix: ignore volumes in wave calculation without provisioning
a16392559 feat: add explicit service account support to Talos client
4d531884e chore: update dependencies
406b8c83c feat: update doc links to docs.siderolabs.com
87615f551 feat: implement network policies with Flannel CNI
6995bc1b1 chore: update homebrew formula on release
7942d5a98 fix: image gc controller config
52e8727d0 feat: add IPv6 GRE support
9690dbad0 chore: bump tools (including linter)
2628eb2ec fix: typo with rpi_5 profile name
d5ebcd7ca fix: stop building talosctl debug on Windows
8b85c7c63 chore: update deps
d905035b5 fix: swap volume configuration for min/max size
d43a01ccb feat: implement talosctl debug
34a31c979 feat: add mount options support for existing volumes
1bf95eed1 feat: improve dashboard uptime display </details>

Changes from siderolabs/discovery-api

<details><summary>2 commits</summary>

9c06846 feat: change the way excluded addresses are specified
f71a14a feat: add advertised filters to discovery data </details>

Changes from siderolabs/go-cmd