NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Go modules · #311 by repository stars
Last release today
08 Oct 2026
Ships on a steady schedule
a new release about every 8 days
Some releases are documented
notes for 17 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
9 years old
3097 releases · first in 2018
Nothing published for this version
Nothing published for this version
The command images deprecated in Talos 1.5 was removed, please use talosctl images default instead.
Welcome to the v1.6.0-alpha.1 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.
Previously, network device selectors only matched the first link, now the configuration is applied to all matching links.
Starting with Talos 1.6, there is no Linux firmware included in the initramfs. Customers who need Linux firmware can pull them as extension during install time using the image factory service. If the initial boot requires firmware, a custom iso can be built with the firmware included using the image factory service. This also ensures that the linux-firmware is not tied to a specific Talos version.
KubePrism is enabled by default on port 7445.
The command images deprecated in Talos 1.5 was removed, please use talosctl images default instead.
Linux: 6.1.58 containerd: 1.7.7 CoreDNS: 1.11.1 Kubernetes: 1.29.0-alpha.2 Flannel: 0.22.3
Talos is built with Go 1.21.3.
<details><summary>131 commits</summary> <p>
9dfae8467 chore: update dependencies38ce3c827 feat: nocloud prefer mac address401e89411 feat: customize image size865f08f86 docs: kubeadm migration guide improvementsc3e418200 refactor: use COSI runtime with new controller runtime DBc1ee24465 feat: update Kubernetes to v1.29.0-alpha.20ff7350ab fix: oracle integration fixes675bada45 test: add config generation stability testsf9639fb53 test: fix 'talosctl gen' tests6142d87a0 feat: hostname configuration improvements on the NoCloud platform7bb205ebe fix: don't use runtime-specs Mount struct in machine configd1b27926c feat: update Go to 1.21.3b87092ab6 fix: handle secure boot state policy pcr digest error498aeb8c3 docs: fix incorrect image suffixc14a5d4f7 feat: support service account auth in cli336aee0fd fix: use tpm2 hash algorithm constants and allow non-SHA-256 PCRs69d8054c9 chore: drop UpdateEndpointSuiteef7be16c8 fix: clear the encryption config in META when STATE is reset5fc60d2ca feat: add Solarflare SFC9000 support9b5cfdd0b chore: add tests for iscsib897764f8 docs: update proxmox.md159f45bde docs: fix typos in CLI calls to endpoints0bd1bdd74 chore: allow insecure access to installer base image (imager)10ed13067 fix: the node IP for kubelet shouldn't change if nothing matchese7575ecaa feat: support n-5 latest Kubernetes versionse71508ec1 chore: update dependencies6d7fa4668 docs: add metal network configuration guide2b548ad0d feat: update containerd to 1.7.x62dcfe81e fix: update kubernetes library to support 1.29 upgrades52caf0763 feat: update Kubernetes to 1.29.0-alpha.1390137447 feat: enable KubePrism by default1beb5e86e docs: add KubePrism videoa52d3cda3 chore: update gen and COSI runtime29b201d61 feat: enable common h/w sensors9c2ba7c6f chore: add tests for chelsio drivers5ca4d58dc fix: generate of modules.dep when on the machine5efcccb6b chore: bump kernel to 6.1.5429c767a02 docs: add control plane nodes as users of apid also for control plane nodes4874cfb95 chore: fix typo96f2a62ea test: update upgrade tests versionsf3a370acb feat: update Flannel to 0.22.3efdee6965 feat: update Kubernetes to 1.28.2e3b494058 fix: build CPU ucode correctly for early loaderc5bd0ac5c refactor: reimplement the depmod extension rebuilder0b883f52a docs: add notes about stable addressing3ef670a9e chore: pull in dm modules8f4a36b0d docs: update aws to add command to allow KubeSpan wireguard porta7edd0523 fix: set default route priority for hcloud platform87c1b3ddd fix: calculate UKI ISO size dynamically9698e4547 fix: handle correctly change of listen address for maintenance servicea096f05a5 chore: update gRPC library and enable shared write buffers9e78fecca chore: improve image signing processf00567e20 chore: add PKG_KERNEL arg to customize used kernel2960f93ba feat: add readonly information to the disks API response735bf9ed0 feat: bring in Google vNIC driver3f5232075 feat: upgrade-k8s without commentse44875106 docs: update deploying-cilium.md7046cae43 chore: update gopacket to reduce init memory allocsda73b563d chore: update Go to 1.21.15e11f08a6 fix: trim file path in the container image3d2dad4e6 chore: show securtiystate on dashboardb48510874 chore: e2e-aws cleanup1eebbce35 chore: add output flag for talosctl config info3fbed806c chore: add tests for util-linux extensions7c514a1a6 docs: update header links6058c3602 fix: shorten VLAN link names to fit into the limit of 15 characters9c2f765c8 fix: allow network device selector to match multiple linksa04b98637 fix: update kubernetes library for 1.28 upgrade pre-checksf7473e477 feat: update default Kubernetes to 1.28.1d693604a1 chore: fix default image list in the release notesd91b5b3a3 feat: set environment variables early in the bootc918c0855 fix: set correct (1 year) talosconfig expiration79bbdf454 fix: set proper timeouts for KubePrism loadbalancerb8fb55d5c fix: use a mount prefix when installing a bootloader44f59a804 feat: improve imager APIs2d3ac925e refactor: update NTP spike detectoraf0cc70e3 test: update e2e-aws to use worker groupsd03dc7a8a chore: validate new system extensionsbbeb489aa chore: drop firmware from initramfs3c9f7a7de chore: re-enable nolintlint and typecheck lintersc51e2c9b4 feat: update CoreDNS to 1.11.18670450d2 release(v1.6.0-alpha.0): prepare release6778ded29 feat: add e2e-aws for nvidia extensions74c07ed71 chore: update Go to 1.21a28d72e9c fix: ova contents to be named disk.*c0ea4d7ba fix: properly calculate overal of node address with subnet filtersd6b2719e2 chore: drone: move extensions step to a function9608ef56d chore: allow bridge traffic with DHCP broadcast trafficc99316457 docs: fix the installing system extensions doc833895940 chore: add tests for zfs extensioncb468c41c fix: copy proper modules to arm64 squashfsea0d6e8c6 fix: prevent dashboard crashes when process info is not availablee9077a6fb feat: filter the hostname to produce nodenamedc8361c1d fix: properly GC images supplied with both tag and digestccfa8de11 fix: automatically change rpi_4 board on upgradeb56e8b7d9 fix: support 'List' type manifests574d48e54 fix: use image digest when starting a container175747cea fix: ntp query error with bare IPv6 addressc8b507fb2 docs: fix kubeprism typo0cdcb2e0e docs: restructure docs for nvidia drivers for v1.4676db9768 docs: fork docs for Talos 1.692ad18c18 fix: write correct capacity to the ovf6b0373ebe chore: move bash tests to integration52b3d8d37 docs: make Talos 1.5 documentation the default onedc873df9b chore: fix the filenames of openstack imagesb5c0e7b24 docs: update nvidia docs9606e871e docs: update Jiva Pod Security Policya86ed4362 chore: update Kubernetes Go modules to 0.28.097b4e3e91 feat: update Kubernetes to 1.28.079ca1a3df feat: e2e-aws using tf codebf3a5e011 chore: add version compatibility for Talos 1.6969e8097c feat: update Kubernetes to 1.28.0-rc.1ca41b611e chore: drone jsonnet cleanupbc198e98e docs: retain cilium autoMount pending upstream hostPath fix86c94eff8 refactor: docgen and config examplesee6d639f6 fix: match routes on the priority properlybff0d8f32 chore: fix dependencies in the release pipelinee1b288679 refactor: compile regex in validation method on the first usedaa4c185a docs: add what's new and documentation for Talos 1.5c4a1ca8d6 chore: remove <-errCh where possible in grpc methodse0f383598 chore: clean up the output of the imagerfb536af4d chore: optimize memory usage of tcell library on init7c86a365e chore: publish systemd-boot and systemd-stub assets7d688ccfe fix: make encryption config provider default to luks2 if not set80238a05a chore: unify semver under github.com/blang/semver/v40f1920bdd chore: provide a resource to peek into Linux clock adjustments4eab3017b fix: calculate log2i properlybcf284530 fix: update providerid prefix for awsac2aff5cc fix: fix azure portion of cloud uploader793dcedc9 fix: fast-wipe the system disk on talosctl reset76fa45afb docs: update cilium instructions
</p>
</details><details><summary>81 commits</summary> <p>
9dfae8467 chore: update dependencies38ce3c827 feat: nocloud prefer mac address401e89411 feat: customize image size865f08f86 docs: kubeadm migration guide improvementsc3e418200 refactor: use COSI runtime with new controller runtime DBc1ee24465 feat: update Kubernetes to v1.29.0-alpha.20ff7350ab fix: oracle integration fixes675bada45 test: add config generation stability testsf9639fb53 test: fix 'talosctl gen' tests6142d87a0 feat: hostname configuration improvements on the NoCloud platform7bb205ebe fix: don't use runtime-specs Mount struct in machine configd1b27926c feat: update Go to 1.21.3b87092ab6 fix: handle secure boot state policy pcr digest error498aeb8c3 docs: fix incorrect image suffixc14a5d4f7 feat: support service account auth in cli336aee0fd fix: use tpm2 hash algorithm constants and allow non-SHA-256 PCRs69d8054c9 chore: drop UpdateEndpointSuiteef7be16c8 fix: clear the encryption config in META when STATE is reset5fc60d2ca feat: add Solarflare SFC9000 support9b5cfdd0b chore: add tests for iscsib897764f8 docs: update proxmox.md159f45bde docs: fix typos in CLI calls to endpoints0bd1bdd74 chore: allow insecure access to installer base image (imager)10ed13067 fix: the node IP for kubelet shouldn't change if nothing matchese7575ecaa feat: support n-5 latest Kubernetes versionse71508ec1 chore: update dependencies6d7fa4668 docs: add metal network configuration guide2b548ad0d feat: update containerd to 1.7.x62dcfe81e fix: update kubernetes library to support 1.29 upgrades52caf0763 feat: update Kubernetes to 1.29.0-alpha.1390137447 feat: enable KubePrism by default1beb5e86e docs: add KubePrism videoa52d3cda3 chore: update gen and COSI runtime29b201d61 feat: enable common h/w sensors9c2ba7c6f chore: add tests for chelsio drivers5ca4d58dc fix: generate of modules.dep when on the machine5efcccb6b chore: bump kernel to 6.1.5429c767a02 docs: add control plane nodes as users of apid also for control plane nodes4874cfb95 chore: fix typo96f2a62ea test: update upgrade tests versionsf3a370acb feat: update Flannel to 0.22.3efdee6965 feat: update Kubernetes to 1.28.2e3b494058 fix: build CPU ucode correctly for early loaderc5bd0ac5c refactor: reimplement the depmod extension rebuilder0b883f52a docs: add notes about stable addressing3ef670a9e chore: pull in dm modules8f4a36b0d docs: update aws to add command to allow KubeSpan wireguard porta7edd0523 fix: set default route priority for hcloud platform87c1b3ddd fix: calculate UKI ISO size dynamically9698e4547 fix: handle correctly change of listen address for maintenance servicea096f05a5 chore: update gRPC library and enable shared write buffers9e78fecca chore: improve image signing processf00567e20 chore: add PKG_KERNEL arg to customize used kernel2960f93ba feat: add readonly information to the disks API response735bf9ed0 feat: bring in Google vNIC driver3f5232075 feat: upgrade-k8s without commentse44875106 docs: update deploying-cilium.md7046cae43 chore: update gopacket to reduce init memory allocsda73b563d chore: update Go to 1.21.15e11f08a6 fix: trim file path in the container image3d2dad4e6 chore: show securtiystate on dashboardb48510874 chore: e2e-aws cleanup1eebbce35 chore: add output flag for talosctl config info3fbed806c chore: add tests for util-linux extensions7c514a1a6 docs: update header links6058c3602 fix: shorten VLAN link names to fit into the limit of 15 characters9c2f765c8 fix: allow network device selector to match multiple linksa04b98637 fix: update kubernetes library for 1.28 upgrade pre-checksf7473e477 feat: update default Kubernetes to 1.28.1d693604a1 chore: fix default image list in the release notesd91b5b3a3 feat: set environment variables early in the bootc918c0855 fix: set correct (1 year) talosconfig expiration79bbdf454 fix: set proper timeouts for KubePrism loadbalancerb8fb55d5c fix: use a mount prefix when installing a bootloader44f59a804 feat: improve imager APIs2d3ac925e refactor: update NTP spike detectoraf0cc70e3 test: update e2e-aws to use worker groupsd03dc7a8a chore: validate new system extensionsbbeb489aa chore: drop firmware from initramfs3c9f7a7de chore: re-enable nolintlint and typecheck lintersc51e2c9b4 feat: update CoreDNS to 1.11.1
</p>
</details><details><summary>4 commits</summary> <p>
6d48418 feat: update Go to 1.21.309d7c3e chore: update releasesa011245 feat: update Go to 1.21.1d3f54c7 feat: update Go to 1.20.8
</p>
</details><details><summary>2 commits</summary> <p>
efca710 chore: add FilterInPlace method to maps and update module36a3ae3 feat: update module
</p>
</details><details><summary>5 commits</summary> <p>
09fa006 fix: retry Windows connection errors3aa47a4 feat: support Kubernetes 1.29 upgradesae33a4a feat: introduce support for Kubernetes version compatibility checkscf2754e chore: update to use GHA44e26b3 feat: update removed feature gates for 1.28
</p>
</details><details><summary>24 commits</summary> <p>
2e892fd feat: update versions37348d6 feat: update Go to 1.21.334f3c41 feat: add Solarflare SFC9000 support0c84090 feat: update releases19cdf71 feat: enable common sensorsacee18e chore: bump kernel to 6.1.541d16fd2 feat: add Chelsio support4504f83 chore: rename kconfig-hardened-check847a9c3 chore: enable dm thin provisioning1401505 chore: drop -pkgs for upstream kernel modulesa62471d feat: add binfmt_misc support518c441 feat: add gVNIC support7d9e60e feat: update Go to 1.21.1d3d7d29 chore: bump deps3b70656 chore: fix cacert permscca80b7 feat: update Linux to 6.1.462e1c0b9 fix: nonfree kmod pkg namecff5beb feat: add btrfs support7717b7e chore: bump deps2f19f18 feat: update containerd to 1.6.2330d4b74 feat: update Go to 1.21eda123d feat: update runc to 1.1.930cd584 chore: enable pushing of non-free packagesfb247b5 chore: update kernel and microcode
</p>
</details><details><summary>6 commits</summary> <p>
9c09b00 feat: update dependencies35948af feat: update Go to 1.21.309023c1 feat: update OpenSSL to 3.1.37fa8bb5 feat: update releasesfa388de feat: update Go to 1.21.133fb4b3 feat: update Go to 1.21
</p>
</details>Previous release can be found at v1.5.0
One column per quarter.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
The command images deprecated in Talos 1.5 was removed, please use talosctl images default instead.
Welcome to the v1.6.0-alpha.0 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.
The command images deprecated in Talos 1.5 was removed, please use talosctl images default instead.
Linux: 6.1.46
Talos is built with Go 1.21.
<details><summary>48 commits</summary> <p>
74c07ed71 chore: update Go to 1.21a28d72e9c fix: ova contents to be named disk.*c0ea4d7ba fix: properly calculate overal of node address with subnet filtersd6b2719e2 chore: drone: move extensions step to a function9608ef56d chore: allow bridge traffic with DHCP broadcast trafficc99316457 docs: fix the installing system extensions doc833895940 chore: add tests for zfs extensioncb468c41c fix: copy proper modules to arm64 squashfsea0d6e8c6 fix: prevent dashboard crashes when process info is not availablee9077a6fb feat: filter the hostname to produce nodenamedc8361c1d fix: properly GC images supplied with both tag and digestccfa8de11 fix: automatically change rpi_4 board on upgradeb56e8b7d9 fix: support 'List' type manifests574d48e54 fix: use image digest when starting a container175747cea fix: ntp query error with bare IPv6 addressc8b507fb2 docs: fix kubeprism typo0cdcb2e0e docs: restructure docs for nvidia drivers for v1.4676db9768 docs: fork docs for Talos 1.692ad18c18 fix: write correct capacity to the ovf6b0373ebe chore: move bash tests to integration52b3d8d37 docs: make Talos 1.5 documentation the default onedc873df9b chore: fix the filenames of openstack imagesb5c0e7b24 docs: update nvidia docs9606e871e docs: update Jiva Pod Security Policya86ed4362 chore: update Kubernetes Go modules to 0.28.097b4e3e91 feat: update Kubernetes to 1.28.079ca1a3df feat: e2e-aws using tf codebf3a5e011 chore: add version compatibility for Talos 1.6969e8097c feat: update Kubernetes to 1.28.0-rc.1ca41b611e chore: drone jsonnet cleanupbc198e98e docs: retain cilium autoMount pending upstream hostPath fix86c94eff8 refactor: docgen and config examplesee6d639f6 fix: match routes on the priority properlybff0d8f32 chore: fix dependencies in the release pipelinee1b288679 refactor: compile regex in validation method on the first usedaa4c185a docs: add what's new and documentation for Talos 1.5c4a1ca8d6 chore: remove <-errCh where possible in grpc methodse0f383598 chore: clean up the output of the imagerfb536af4d chore: optimize memory usage of tcell library on init7c86a365e chore: publish systemd-boot and systemd-stub assets7d688ccfe fix: make encryption config provider default to luks2 if not set80238a05a chore: unify semver under github.com/blang/semver/v40f1920bdd chore: provide a resource to peek into Linux clock adjustments4eab3017b fix: calculate log2i properlybcf284530 fix: update providerid prefix for awsac2aff5cc fix: fix azure portion of cloud uploader793dcedc9 fix: fast-wipe the system disk on talosctl reset76fa45afb docs: update cilium instructions
</p>
</details><details><summary>8 commits</summary> <p>
2e1c0b9 fix: nonfree kmod pkg namecff5beb feat: add btrfs support7717b7e chore: bump deps2f19f18 feat: update containerd to 1.6.2330d4b74 feat: update Go to 1.21eda123d feat: update runc to 1.1.930cd584 chore: enable pushing of non-free packagesfb247b5 chore: update kernel and microcode
</p>
</details><details><summary>1 commit</summary> <p>
33fb4b3 feat: update Go to 1.21
</p>
</details>Previous release can be found at v1.5.0
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
The .machine.install.bootloader option in the machine config is deprecated and will be removed in Talos 1.6. This was a no-op for a long time. The boo…
Welcome to the v1.5.0-alpha.3 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.
Talos now supports setting environmentFile for an extension service container spec. Refer: https://www.talos.dev/v1.5/advanced/extension-services/#container
The extension waits for the file to be present before starting the service.
Starting with version Talos 1.5, network interfaces are renamed to predictable names
same way as systemd does that in other Linux distributions.
The naming schema enx78e7d1ea46da (based on MAC addresses) is enabled by default, the order of interface naming decisions is:
eno1)ens1)enp2s0)enx78e7d1ea46da)The predictable network interface names features can be disabled by specifying net.ifnames=0 in the kernel command line.
Talos automatically adds the net.ifnames=0 kernel argument when upgrading from Talos versions before 1.5.
This change doesn't affect "cloud" platforms, like AWS, as Talos automatically adds net.ifnames=0 to the kernel command line.
Talos now supports new type of encryption keys which are sealed/unsealed with an external KMS server:
systemDiskEncryption:
ephemeral:
keys:
- kms:
endpoint: https://1.2.3.4:443
slot: 0
gRPC API definitions and a simple reference implementation of the KMS server can be found in this repository.
Talos now supports configuring the KubePrism - Kubernetes API Server in-cluster load balancer with machine config
features.kubePrism.port and features.kubePrism.enabled fields.
If enabled, KubePrism binds to localhost and runs on the same port on every machine in the cluster.
The default value for KubePrism endpoint is https://localhost:7445.
The KubePrism is used by the kubelet, kube-scheduler, kube-controller-manager
and kube-proxy by default and can be passed to the CNIs like Cilium and Calico.
The KubePrism provides access to the Kubernetes API endpoint even if the external loadbalancer is not healthy, provided that the worker nodes can reach to the controlplane machine addresses directly.
.machine.install.bootloaderThe .machine.install.bootloader option in the machine config is deprecated and will be removed in Talos 1.6.
This was a no-op for a long time. The bootloader is always installed.
Talos 1.5+ enables XFS project quota support by default, also enabling by default
kubelet feature gate LocalStorageCapacityIsolationFSQuotaMonitoring to use xfs quotas
to monitor volume usage instead of du.
This feature is controlled by the .machine.features.diskQuotaSupport field in the machine config,
it is set to true for new clusters.
When upgrading from a previous version, the feature can be enabled by setting the field to true. On the first mount of a volume, the quota information will be recalculated, which may take some time.
Talos no longer loads by default rdma_rxe Linux driver, which is required for RoCE support.
If the driver is required, it can be enabled by specifying rdma_rxe in the .machine.kernel.modules field in the machine config.
Talos now supports generating a custom iso that can be used with SecureBoot. Key generation and enrolling has to be done manually.
talosctl image CommandA new set of commands was introduced to manage container images in the CRI:
talosctl image list shows list of available imagestalosctl image pull allows to pre-pull an image into the CRIBoth new commands accept --namespace flag with two possible values:
cri (default): images managed by the CRI (Kubernetes workloads)system: images managed by Talos (etcd and kubelet)
### `talosctl images` Command
The command `talosctl images` was renamed to `talosctl image default`.
The backward-compatible alias is kept in Talos 1.5, but it will be dropped in Talos 1.6.
### TPM Disk Encryption
Talos now supports encrypting STATE/EPHEMERAL with keys bound to a TPM device. The TPM device must be TPM2.0 compatible.
This is ideally supported when booting with new Talos SecureBoot UKI ISOs/Metal images. This feature would still work if SecureBoot
is not enabled for UKI images, but not recommended since there is no way to verify the trust of the bootloader.
Example machine config:
systemDiskEncryption: ephemeral: keys: - slot: 0 tpm: {} state: keys: - slot: 0 tpm: {}
### Component Updates
* Linux: 6.1.39
* containerd: 1.6.21
* runc: 1.1.8
* etcd: 3.5.9
* Kubernetes: 1.28.0-beta.0
* Flannel: 0.22.0
Talos is built with Go 1.20.6.
### `talosctl upgrade-k8s` Image Pre-pulling
The command `talosctl upgrade-k8s` now by default pre-pulls images for Kubernetes controlplane components
and kubelet. This provides an early check for missing images, and minimizes downtime during Kubernetes
rolling component update.
### Contributors
* Andrey Smirnov
* Noel Georgi
* Dmitriy Matrenichev
* Utku Ozdemir
* Artem Chernyshev
* Christian Rolland
* Steve Francis
* Nanfei Chen
* Nico Berlee
* Spencer Smith
* Alex Corcoles
* Alex Corcoles
* Alex Lubbock
* Andrei Kvapil
* Artem Chernyshev
* Budiman Jojo
* Chris Hoffman
* DJAlPee
* Dennis Marttinen
* Eirik Askheim
* Florian Klink
* Henk Kraal
* Igor Rzegocki
* James Callahan
* LukasAuerbeck
* Markus Reiter
* Michael A. Davis
* Michael Fornaro
* Niklas Wik
* Piotr Maksymiuk
* Ricky Sadowski
* Roee Klinger
* Sacha Trémoureux
* Scott Cariss
* Serge Logvinov
* Thomas Lemarchand
* Thomas Perronin
* Tim Jones
* Victor Bajada
* Walt Chen
* bdronneau
### Changes
<details><summary>194 commits</summary>
<p>
* [`d2f64af86`](https://github.com/siderolabs/talos/commit/d2f64af863e14b1d111bbeeaa6d9077aadaf6085) chore: disable cloud-images, pull in new kernel and gre module
* [`8edce4906`](https://github.com/siderolabs/talos/commit/8edce490639c213cd8c45989a5a87e3388179d37) docs: improve proxmox install guide
* [`c783458be`](https://github.com/siderolabs/talos/commit/c783458be0c90b779bcc2fe3c10e37fd3dfe01db) docs: typo dhcp -> dhcp
* [`003cbd161`](https://github.com/siderolabs/talos/commit/003cbd161196375edc8ee5033be62014eb88202e) docs: warn about secretboxEncryptionSecret in kubeadm migration guide
* [`786e86f5b`](https://github.com/siderolabs/talos/commit/786e86f5b8219ef37c5c6480d97c440cbbd53e30) refactor: rewrite the way Talos acquires the machine configuration
* [`5e13cafe5`](https://github.com/siderolabs/talos/commit/5e13cafe5b506039fdd652372b1d1f71a1c1c10b) feat: enforce kernel lockdown for UKI
* [`4d96d642f`](https://github.com/siderolabs/talos/commit/4d96d642fd9c462db2c084afee1428009d454a9e) feat: update default Kubernetes version to 1.28.0-beta.0
* [`170a73e16`](https://github.com/siderolabs/talos/commit/170a73e161eacb0e21ce95e7a7e406533552bf1d) chore: support creating qemu guest socket
* [`59ac38a6b`](https://github.com/siderolabs/talos/commit/59ac38a6bffe943fa634b124b8ec2a907f95a006) docs: add docs for installing azure ccm and csi
* [`6288cd970`](https://github.com/siderolabs/talos/commit/6288cd970e83f18e8b1cadca777deabe3ff9fc91) release(v1.5.0-alpha.2): prepare release
* [`60c304126`](https://github.com/siderolabs/talos/commit/60c304126fce95fd4995c416e7757f85505b90fb) chore: bump dependencies
* [`9ef4e5efc`](https://github.com/siderolabs/talos/commit/9ef4e5efca4b537a550a5e902fc2479ebb5e53e3) fix: log explicitly when kubelet has no nodeIP match
* [`6b39c6a4d`](https://github.com/siderolabs/talos/commit/6b39c6a4d326752f92d98388bbb418f2e50d3ddb) fix: enable compression and bump gRPC max msg size
* [`2f2eca861`](https://github.com/siderolabs/talos/commit/2f2eca86175fe98b3bf491f38ff907599333b139) chore: basic support for shutdown/poweroff flags
* [`b84277d7d`](https://github.com/siderolabs/talos/commit/b84277d7dc50b196b7cd27e7f2ceff6bf8f58a8d) docs: fix wrong capability name
* [`59d7d9344`](https://github.com/siderolabs/talos/commit/59d7d9344b27529af420ec31c7b599027cda044f) chore: use machined for `shutdown`, `poweroff`
* [`2439bfb71`](https://github.com/siderolabs/talos/commit/2439bfb719d9f50107cee500d03c90bd50649e05) chore: explicitly add timestamps to machined logs
* [`14966e718`](https://github.com/siderolabs/talos/commit/14966e718a07906ff389ecdda063fd16b22baab9) fix: skip over tpm2 1.2 devices
* [`6716e7bc0`](https://github.com/siderolabs/talos/commit/6716e7bc0ba6da31b8bc19aa4bd5edb7749b39a1) docs: update cilium documentation about KubePrism usage
* [`166d75fe8`](https://github.com/siderolabs/talos/commit/166d75fe888d334349f57dcf405b6867ca5305e2) fix: tpm2 encrypt/decrypt flow
* [`130518de7`](https://github.com/siderolabs/talos/commit/130518de71ae96cdf7d733a35e4c306940e1b845) chore: change missing renames of KubePrism
* [`5f34f5b41`](https://github.com/siderolabs/talos/commit/5f34f5b41f03d6d455d7b843084d2951c365a7ee) chore: rename api load balancer to KubePrism
* [`c8b7095c0`](https://github.com/siderolabs/talos/commit/c8b7095c01f597cd8b41964b42aa7e35c85ae307) refactor: use tpm2 library to calculate policy hash
* [`078aac92e`](https://github.com/siderolabs/talos/commit/078aac92ee30c9666235219d4623b82d66362d4d) chore: bump deps
* [`53873b844`](https://github.com/siderolabs/talos/commit/53873b8444acaa97d85c50caec625b9dbfdfef93) refactor: move ukify into Talos code
* [`d5f6fb9ff`](https://github.com/siderolabs/talos/commit/d5f6fb9ff2980df03365719d9e2690cb5ac788af) chore: add vendor info
* [`79365d9ba`](https://github.com/siderolabs/talos/commit/79365d9bacf0e8a6660cdc6b7172c79edf5f3ba3) feat: tpm2 based disk encryption
* [`06369e819`](https://github.com/siderolabs/talos/commit/06369e8195e76f96d232d077efb2bfb059b7aa96) fix: retry CRI pod removal, fix upgrade flow in the tests
* [`d32dd3a82`](https://github.com/siderolabs/talos/commit/d32dd3a820b07d58ca89c4226c986d87ff0e2b65) chore: update Go to 1.20.6
* [`8017afb10`](https://github.com/siderolabs/talos/commit/8017afb107b901a8785bccaac65d63f34e506568) feat: implement CRI image management and pre-pull on K8s upgrade
* [`1c2f19b36`](https://github.com/siderolabs/talos/commit/1c2f19b367af8b04fc49174540e5b141f4b34156) feat: update Kubernetes to 1.28.0-alpha.4
* [`94e9891c1`](https://github.com/siderolabs/talos/commit/94e9891c1bb44a1e7c285b4ccf1fad59ea05aa62) chore: bump sd-boot to v254-rc1
* [`936111ce0`](https://github.com/siderolabs/talos/commit/936111ce062d23ed11b30ea35585c0519260f9c5) fix: properly set up tls for KMS endpoint
* [`cb226eec4`](https://github.com/siderolabs/talos/commit/cb226eec46b59372c684c3946e0ba0910066573d) fix: rewrite encryption system information flow
* [`3206db528`](https://github.com/siderolabs/talos/commit/3206db52895416d1eb936caa4e953312b34b8549) feat: drop tpm simulator for ukify measure
* [`bd4f89f63`](https://github.com/siderolabs/talos/commit/bd4f89f6338423a79b7ce89bda1bd6704caaae59) fix: disable dashboard on Azure, GCP and Scaleway
* [`bdb96189f`](https://github.com/siderolabs/talos/commit/bdb96189faadc48e93146f9fd7b03e006bf1dd75) refactor: make maintenance service controller-based
* [`d23d04de2`](https://github.com/siderolabs/talos/commit/d23d04de2a5dee30ccf21efe767daf229de78bdb) feat: seed the kernel random pool from the TPM
* [`c81ce8cfb`](https://github.com/siderolabs/talos/commit/c81ce8cfb0bc7df66ffd1e1819b64dad6357d890) feat: support controlplane resources configuration
* [`74de562b2`](https://github.com/siderolabs/talos/commit/74de562b29c748fda3140871ea3fab99698341ef) fix: mount hugepages with nosuid + nodev
* [`ce63abb21`](https://github.com/siderolabs/talos/commit/ce63abb219a2fd4a9d3fdd93a13c343af123efc2) feat: add KMS assisted encryption key handler
* [`dafbe9deb`](https://github.com/siderolabs/talos/commit/dafbe9debdee2b015ed574ac4f5f722bce997b31) chore: optimize dockerfile instructions
* [`a4289e870`](https://github.com/siderolabs/talos/commit/a4289e8703d9f9e52b739b19b5b38e30a75a1454) chore: fix CLI docs generation stability
* [`2fec8388f`](https://github.com/siderolabs/talos/commit/2fec8388fc2fe3058b7b6f141ce9eae2c6a8268f) chore: bump dependencies
* [`c1b4262dd`](https://github.com/siderolabs/talos/commit/c1b4262dd60f6cbea6d46a8d0433499bf6365b36) docs: split simple and more complex getting started guides
* [`c9a9f9561`](https://github.com/siderolabs/talos/commit/c9a9f95611e38cf5c298f0d9fb0890a9bc0f8b98) refactor: extract secure boot certificate generation
* [`6be5a13d5`](https://github.com/siderolabs/talos/commit/6be5a13d5d8341c58d0d2fe75c49ba1de9bf7316) feat: implement machine config documents for event and log streaming
* [`e241be85b`](https://github.com/siderolabs/talos/commit/e241be85ba748163268eaeed2a88c8e295f84b28) fix: properly handle YAML comment stripping for multi-doc
* [`c02ada7d9`](https://github.com/siderolabs/talos/commit/c02ada7d952255bffe67b3c84f1f832253e1a3b5) fix: capabilities including `ALL` should be uppercase
* [`cbdf96d46`](https://github.com/siderolabs/talos/commit/cbdf96d461ec0cf8929c2c76614081ef042dda31) feat: support environment file for extensions
* [`35d6adcb9`](https://github.com/siderolabs/talos/commit/35d6adcb9ad7e9420a5bcdfcf3378a05c0b65d46) fix: provide stashed META values before installation
* [`258f07449`](https://github.com/siderolabs/talos/commit/258f07449050d69c369fdc71ac613a1a225807bf) fix: ukify cert generation
* [`bf3febb7e`](https://github.com/siderolabs/talos/commit/bf3febb7e2bf3ebf1bd66ee088f3885a178c953c) fix: refine OVMF search paths
* [`fbebc17f8`](https://github.com/siderolabs/talos/commit/fbebc17f8be7a3ca6c45c3c84d306e52c47d441d) fix: disable LVM backups/archive
* [`e5306ef26`](https://github.com/siderolabs/talos/commit/e5306ef2637dd2eb7464691b55159a43933c7419) chore: format and cleanup test scripts
* [`bc371ecfd`](https://github.com/siderolabs/talos/commit/bc371ecfdafe51f8cf34461caf9e6f51c0a93108) chore: add `/sbin/shutdown`
* [`0d313b973`](https://github.com/siderolabs/talos/commit/0d313b973367906b2fd4bcad4b2def79344dbd67) feat: add `reboot-mode` flag to `talosctl upgrade`
* [`7ce87f20c`](https://github.com/siderolabs/talos/commit/7ce87f20c39c615f4d23a3be23780a36008dcb19) fix: compare only basename of `os.Args[0]` in machined
* [`53389b1e7`](https://github.com/siderolabs/talos/commit/53389b1e724751e28046167b44f05c6ecf06f184) feat: auto-enroll secure boot keys
* [`d77f0bc7b`](https://github.com/siderolabs/talos/commit/d77f0bc7bbe01b7fc8efa21a7c57d73ecb94a01f) docs: fix broken link to powershell module
* [`e1b150a11`](https://github.com/siderolabs/talos/commit/e1b150a11014ddd0c60585d320dd7cd556cf2a0c) release(v1.5.0-alpha.1): prepare release
* [`8daf432b2`](https://github.com/siderolabs/talos/commit/8daf432b2957a8f9d5c59970cf68e7e8414038f5) chore: bump deps
* [`e3f3f5794`](https://github.com/siderolabs/talos/commit/e3f3f5794d276433748d0e677ed8476a54f8a98e) feat: implement revert for sd-boot
* [`d8b0903d7`](https://github.com/siderolabs/talos/commit/d8b0903d70181afc901d8ddb71bdfa964d4df2cd) docs: vagrant setup document fix
* [`fe0f46980`](https://github.com/siderolabs/talos/commit/fe0f46980f348852907218d6f49581efe4b45d49) feat: implement secure boot from disk
* [`445f5ad54`](https://github.com/siderolabs/talos/commit/445f5ad5426b125e29d86ff096695399bd01eb32) feat: support API server load balancer
* [`19bc223de`](https://github.com/siderolabs/talos/commit/19bc223de8ad878bffe539bda617d5f861af3cfe) refactor: bootloader interface, labels
* [`665702ddd`](https://github.com/siderolabs/talos/commit/665702ddd351e902336e6ab81108ea94d61db5c1) chore: fix cilium e2e tests
* [`71a548d18`](https://github.com/siderolabs/talos/commit/71a548d18013ee16394921759e819b0fabb43758) chore: generic boootloader implementation
* [`e9dbc9311`](https://github.com/siderolabs/talos/commit/e9dbc9311bcbbbcaab2c7eb7f7128013194c234a) test: bump versions for upgrade tests
* [`0a99965ef`](https://github.com/siderolabs/talos/commit/0a99965efbdd5dc0d927eb2cbae209dc143c9541) refactor: replace `uncordonNode` with controllers
* [`e858bca3a`](https://github.com/siderolabs/talos/commit/e858bca3a2f75d5035710d52229c8142f3eb6982) test: fix cilium integration tests
* [`455328d05`](https://github.com/siderolabs/talos/commit/455328d058fba3a5a8b3358820a02e2b4fabad95) fix: allow time skew for generated kubeconfig
* [`3ae05648a`](https://github.com/siderolabs/talos/commit/3ae05648ae0a2f79bebd678f85d63d4e5dafde0a) fix: usage of custom kernels
* [`0797b0d16`](https://github.com/siderolabs/talos/commit/0797b0d16808d115649a9e0e37b355bbbc2a30b5) chore: add a pipeline to test cloud-images step without a release
* [`e5a36268b`](https://github.com/siderolabs/talos/commit/e5a36268b63e588ea6cd2439bf0de356ee07d752) docs: include `allowSchedulingOnControlPlanes` on `talosctl gen config` output
* [`c74d93728`](https://github.com/siderolabs/talos/commit/c74d937280c2ec707936a72d07dc2a5dd252c5d2) chore: bump github.com/cosi-project/runtime
* [`dbaf5c699`](https://github.com/siderolabs/talos/commit/dbaf5c69978fd1d22737385ddd096798d408254c) refactor: task `labelControlPlane` into controllers
* [`1865a0c29`](https://github.com/siderolabs/talos/commit/1865a0c29663a1a78db7ef6e901d450d67a3cbe1) chore: modify some usages that are not recommended
* [`3816318b9`](https://github.com/siderolabs/talos/commit/3816318b9e2e205da0c949c0ec59a087decd0b78) chore: wrap config.Provider in atomic wrapper
* [`d04cf1978`](https://github.com/siderolabs/talos/commit/d04cf19788df20c802eadb9678570a4f15d339b2) chore: clean up unnecessary self assignment
* [`a34a94898`](https://github.com/siderolabs/talos/commit/a34a948985fed7c3054c4342c48e0e0620569625) fix: copy missing modules.* files
* [`f5e3272fc`](https://github.com/siderolabs/talos/commit/f5e3272fce641a878eefa66437d28d3ed9917ab6) refactor: task 'updateBootLoader' as controller
* [`e7be6ee7c`](https://github.com/siderolabs/talos/commit/e7be6ee7c3636eebd557d93e440e9749c8093360) refactor: make event log streaming fully reactive
* [`aef2192a6`](https://github.com/siderolabs/talos/commit/aef2192a6584e7934086eae0caab6faba52a8ac1) chore: use fixed module list
* [`c719aa231`](https://github.com/siderolabs/talos/commit/c719aa2316bffa3b614d27d630ea3d8731684f4e) fix: allow http:// for discovery service URL
* [`39134d8d5`](https://github.com/siderolabs/talos/commit/39134d8d5304cec5e1a1c5fe23f62ed957241213) chore: fix cron pipeline
* [`a61dcdbbd`](https://github.com/siderolabs/talos/commit/a61dcdbbd5c917b49c810108ff96854ad51269b1) fix: don't load RDMA over Ethernet driver by default
* [`aac441f61`](https://github.com/siderolabs/talos/commit/aac441f618ac60f2298d9e17a2044916f7da9d69) chore: update Go to 1.20.5, bump dependencies
* [`1c0c7933d`](https://github.com/siderolabs/talos/commit/1c0c7933dfef23544e2fb0fc04c4c5ad7d5b5d9b) chore: cleanup partition code
* [`31b988281`](https://github.com/siderolabs/talos/commit/31b988281efb9d0c66975bbfc20b893ad32c161d) docs: add some words about certifcates
* [`e912c0dfc`](https://github.com/siderolabs/talos/commit/e912c0dfcf515c5a6c852f4b935c9b48e61b13f1) chore: use go-blockdevice for zeroing partitions
* [`e6dde8ffc`](https://github.com/siderolabs/talos/commit/e6dde8ffc50e435a42d11eb96cf6aea2cf3520ca) feat: add network chaos to qemu development environment
* [`47986cb79`](https://github.com/siderolabs/talos/commit/47986cb79eb30c6e9c0d091ee37b2b1c2f20885c) chore: unify kexec phase
* [`3a865370f`](https://github.com/siderolabs/talos/commit/3a865370f5152243e08a69626de023f924e22689) feat: qemu secureboot
* [`5dab45e86`](https://github.com/siderolabs/talos/commit/5dab45e86917837b0991a62ab94a7b96b3ef777e) refactor: allow kmsg log streaming to be reconfigured on the fly
* [`8a02ecd4c`](https://github.com/siderolabs/talos/commit/8a02ecd4cb97bcaafe5761d464fec8a4e44b672f) chore: add endpoints balancer controller
* [`423a31ac9`](https://github.com/siderolabs/talos/commit/423a31ac9d8f28c2bcf00794bacf5446e43fc0b7) chore: deprectae `bootloader` installer option
* [`cdfece7d6`](https://github.com/siderolabs/talos/commit/cdfece7d64a9269afcc213f8d604d0b7e525cb8a) chore: optimize image compression
* [`bfc341937`](https://github.com/siderolabs/talos/commit/bfc34193762cb309ef2230f4d79673c4a56f4db5) chore: add default console args
* [`2749aeeda`](https://github.com/siderolabs/talos/commit/2749aeeda0451b286369d911696070e2cf4359e9) feat: add support for multi-doc strategic merge patching
* [`3f68485e4`](https://github.com/siderolabs/talos/commit/3f68485e44800a0c50b5855531ec10507e7d0df9) feat: add uki iso generation
* [`bab484a40`](https://github.com/siderolabs/talos/commit/bab484a405cb598d1c5f35f7602c2ac27e6efa97) feat: use stable network interface names
* [`196dfb99b`](https://github.com/siderolabs/talos/commit/196dfb99b0329d5c52fd7089e62fbfa1b09df3c6) fix: do not probe kernel args in dashboard if not needed
* [`8c071b579`](https://github.com/siderolabs/talos/commit/8c071b5796db05ecb17e46295eb2140827a58ca8) fix: skip DHCP RENEW if server IP in the lease is all zeroes
* [`badbc51e6`](https://github.com/siderolabs/talos/commit/badbc51e63b685e22fffb82ae294a35cd9f65922) refactor: rewrite code to include preliminary support for multi-doc
* [`ecce29dee`](https://github.com/siderolabs/talos/commit/ecce29dee9625842e419496e18560291ef90b1b5) fix: upgrade-k8s use internal IP first, external IP fallback
* [`3c64a5ffb`](https://github.com/siderolabs/talos/commit/3c64a5ffba2109ccf5102f71652e54def52f8dbf) chore: optimize image generation time
* [`2292f36d9`](https://github.com/siderolabs/talos/commit/2292f36d970d3edcf39b5d5f12d0051d7d75f390) chore: registry.k8s.io for coredns image
* [`f2b258b37`](https://github.com/siderolabs/talos/commit/f2b258b3733a8fcc34bccde3bf01855a512d519a) docs: document talosctl version for upgrades
* [`a0773f783`](https://github.com/siderolabs/talos/commit/a0773f783cfb3cfab8cbbeffb6449159754d785e) chore: add ukify Go script
* [`b69e38d1f`](https://github.com/siderolabs/talos/commit/b69e38d1ff069ba8fac7a6524621f8b3c7256238) chore: bump dependencies
* [`adce65103`](https://github.com/siderolabs/talos/commit/adce65103424f9f895e6b8c4858b27b3eb6bd74b) docs: add piraeus/drbd to storage documentation
* [`a982cabe7`](https://github.com/siderolabs/talos/commit/a982cabe7011c87e863f7bb0829921e927ddf782) docs: link support matrix in k8s update doc
* [`1fb29a56a`](https://github.com/siderolabs/talos/commit/1fb29a56a8abe5d72b8a3a336693e798424c63e0) fix: fail quickly if upgrade-k8s is used with multiple nodes
* [`51d931c47`](https://github.com/siderolabs/talos/commit/51d931c4705fc7ca0bdadc59d732e56fae318dda) chore: faster dev cycle
* [`dc6764871`](https://github.com/siderolabs/talos/commit/dc6764871c9e732b88f7cddc1784e943e9d952bb) refactor: move around config interfaces, make RawV1Alpha1 typed
* [`ea9a97dba`](https://github.com/siderolabs/talos/commit/ea9a97dba38c6ab2de830e3b0c3d202d22bdb668) fix: fall back to external IP when discovering nodes in upgrade-k8s
* [`0bb7e8a5c`](https://github.com/siderolabs/talos/commit/0bb7e8a5cf8b8f3bf31d9f8c3a85b4153921c126) refactor: split config.Provider into Config & Container
* [`85d8a1619`](https://github.com/siderolabs/talos/commit/85d8a1619431989eb05cb15ad01a1bc06b0f63e9) chore: bump deps
* [`39b7a56f0`](https://github.com/siderolabs/talos/commit/39b7a56f01d41d33eb96a0feb6e34d43965a99fd) chore: use 8GiB instead of 10GiB for cloud images
* [`ff11fd39c`](https://github.com/siderolabs/talos/commit/ff11fd39c723a40c01abe6348f64b1f892856175) fix: race with `udevd` and `mountUserDisks`
* [`c3fabb982`](https://github.com/siderolabs/talos/commit/c3fabb9829d12353770d6436a1d726b15820ebce) chore: update default image sizes to 10GB for all "cloud" images
* [`10155c390`](https://github.com/siderolabs/talos/commit/10155c390e87898098426600709657fbd51e02e8) feat: enable xfs project quota support, kubelet feature
* [`eba818564`](https://github.com/siderolabs/talos/commit/eba81856427dd3f6c0cf317f027e63d65a079029) release(v1.5.0-alpha.0): prepare release
* [`383471c3e`](https://github.com/siderolabs/talos/commit/383471c3e956ff6e077a1de75b02a50835fbf352) feat: update default Kubernetes to v1.27.2
* [`8f68d1abe`](https://github.com/siderolabs/talos/commit/8f68d1abeff83c3ff0e6c5d9f61cb14807b44ca5) chore: bump deps
* [`e0c1585d3`](https://github.com/siderolabs/talos/commit/e0c1585d3047ef213134331dc57f8e2e8c23a93d) feat: create azure community gallery image version on release
* [`dd8336c9e`](https://github.com/siderolabs/talos/commit/dd8336c9ee7f8a3a44d45c9f9e3cbbf741f84c44) fix: refresh kubelet self-issued serving certificates
* [`bb02dd263`](https://github.com/siderolabs/talos/commit/bb02dd263cbc5e7e3839148d86a4a0a5f7ea998b) chore: drop deprecated stuff for Talos 1.5
* [`61cad8673`](https://github.com/siderolabs/talos/commit/61cad86731e5c0aa80d7df41ea02d0b7ff579c45) chore: bump deps
* [`01dfd3af7`](https://github.com/siderolabs/talos/commit/01dfd3af7d64dacd179d17d9d5eaf4bc44cf72af) feat: update etcd to v3.5.9
* [`aa65fbb8a`](https://github.com/siderolabs/talos/commit/aa65fbb8a1752a70e7bac4e4e9872f35e88d1cc9) chore: update KUBECTL_URL to reflect the community bucket
* [`cc3128d94`](https://github.com/siderolabs/talos/commit/cc3128d944abacfb633bc783b7fed6d0a6f80661) chore: bump kernel to 6.1.28
* [`97fffaf78`](https://github.com/siderolabs/talos/commit/97fffaf78a0b9a1dc67709de11d37ea20aefde59) chore: use ctest.UpdateWithConflicts instead of plain UpdateWithConflicts
* [`3b36993b9`](https://github.com/siderolabs/talos/commit/3b36993b9926392f4290e6fabc82e635f4c98149) fix: rlimit nofile test
* [`45e6e27af`](https://github.com/siderolabs/talos/commit/45e6e27af75746fd0cc8b0f98a2d14579eb0ed40) chore: bump runtime
* [`4f720d465`](https://github.com/siderolabs/talos/commit/4f720d46532af39165fc5051052d5c42595d91af) fix: revert: set rlimit explicitly in wrapperd
* [`a2565f674`](https://github.com/siderolabs/talos/commit/a2565f67416e9b9bc22f2d5506df9ea7771c0c8c) fix: set rlimit explicitly in wrapperd
* [`cdfc242b8`](https://github.com/siderolabs/talos/commit/cdfc242b8354f4cc4e7ce51bbe3a8fb20b35995d) chore: re-enable Go buildid
* [`e67f3f5c5`](https://github.com/siderolabs/talos/commit/e67f3f5c5453f947355194ea9656c15ff008c35e) feat: linux 6.1.27, containerd 1.6.21, go 1.20.4
* [`55ae59a0a`](https://github.com/siderolabs/talos/commit/55ae59a0ad71293676b3efed461f5ab98101401a) fix: properly skip/cleanup controlplane configs for workers
* [`64eade9bd`](https://github.com/siderolabs/talos/commit/64eade9bde271bce4e629e6ac09407c8c42e01be) chore: clean up unused constant
* [`62c6e9655`](https://github.com/siderolabs/talos/commit/62c6e9655cb639d4993aaa4c9b364342688599cb) feat: introduce siderolink config resource & reconnect
* [`860002c73`](https://github.com/siderolabs/talos/commit/860002c7352bedd10845e11da37c80685ff0e720) fix: don't reload control plane pods on cert SANs changes
* [`d43c61e80`](https://github.com/siderolabs/talos/commit/d43c61e80f5b05b81f2a021cdfe012e500c3d98e) fix: enforce nolock option for all NFS mounts by default
* [`339986db9`](https://github.com/siderolabs/talos/commit/339986db9d3675b78ce0d268f799ad654862fb0f) fix: inhibit timer to follow kubelet timer
* [`cbf6dc100`](https://github.com/siderolabs/talos/commit/cbf6dc1009ad47a2804774839e4e0301efa8ac78) fix: set timeout for unmount calls
* [`b58f913d5`](https://github.com/siderolabs/talos/commit/b58f913d5f4b8ecf39be183d0bafe1109f0f0737) fix: set the static pod priority as values
* [`f8a7a5b6b`](https://github.com/siderolabs/talos/commit/f8a7a5b6bf4138a33cbe5c9afe85db99de167aec) docs: add information about KubeSpan ports and topology
* [`2bad74d64`](https://github.com/siderolabs/talos/commit/2bad74d6423c083ec34f1b422f23b0024d5f8798) docs: add how to on scaling down
* [`7442ff8b0`](https://github.com/siderolabs/talos/commit/7442ff8b095ef1337f54332a71d08053a2832144) chore: fix typos inteface -> interface (docs and tests)
* [`d4e94f7a1`](https://github.com/siderolabs/talos/commit/d4e94f7a15acf7f3c9e7532b067cdacd0e805bec) fix: add back required TARGETARCH for installer
* [`e6fffda01`](https://github.com/siderolabs/talos/commit/e6fffda01385a2daaa901a5742f30a4edc9186a7) chore: linux 6.1.26, runc 1.1.7
* [`344746ae2`](https://github.com/siderolabs/talos/commit/344746ae2fa038b704d02fec04c3d358762fe938) fix: bump max inhibit delay to 20 min
* [`d9bdea2b5`](https://github.com/siderolabs/talos/commit/d9bdea2b54772f067783ee64eb85c834957d386a) chore: fork docs and compatibility modules for Talos 1.5
* [`3d99610fc`](https://github.com/siderolabs/talos/commit/3d99610fc9b0d0084be822be29bb1bf2fbe85833) docs: document building, verifying image and process caps
* [`014008ea2`](https://github.com/siderolabs/talos/commit/014008ea25208afbeabb42ef89238802705ad4e0) fix: udevd rules trigger
* [`9b36bb613`](https://github.com/siderolabs/talos/commit/9b36bb613b44f182e47ae63bc74e4a8b6342d68d) feat: update Linux to 6.1.25, fix virtio on arm64
* [`08ec66c55`](https://github.com/siderolabs/talos/commit/08ec66c55ccca3f9aa82a9703ebf183913b19a7e) feat: clean up (garbage collect) system images which are not referenced
* [`b097efcde`](https://github.com/siderolabs/talos/commit/b097efcde29c20cdc4fed23fe8366bd683db634c) fix: display correct number of machines on dashboard
* [`cad43f0ad`](https://github.com/siderolabs/talos/commit/cad43f0ad3bc2ede8a6ae81767c9226b6bc69f19) chore: remove k8s master label
* [`e296a566e`](https://github.com/siderolabs/talos/commit/e296a566e6efb0cbdd119e73aff1feaa772d38bd) fix: support kernel userspace module loading
* [`103f0ffdd`](https://github.com/siderolabs/talos/commit/103f0ffdd3ebd57a5086852f3502a8a7d4428faa) feat: add startup probes to controller-manager and scheduler
* [`5a1ae8aae`](https://github.com/siderolabs/talos/commit/5a1ae8aae89e54d5540586d6f2e99ef3e80a72eb) chore: bump dependences
* [`ec8c8dbaf`](https://github.com/siderolabs/talos/commit/ec8c8dbafcdaf63d036bdba92fa153d4d1c90100) chore: fix container image reproducibility
* [`f661d8487`](https://github.com/siderolabs/talos/commit/f661d84877e6db5bc8856b982990926dcbfe949c) fix: allow `talosctl cp` to handle special files in `/proc`
* [`2d824b563`](https://github.com/siderolabs/talos/commit/2d824b5639a4b8c3b673d13b08b2b97c69aafe0d) fix: do not show control plane status for workers on dashboard
* [`e5491ddad`](https://github.com/siderolabs/talos/commit/e5491ddadeb1776bd5c17dd35917e05ec4847d0f) docs: update documentation for nocloud
* [`7a004a6f7`](https://github.com/siderolabs/talos/commit/7a004a6f7f47fa5d17e855eb02650754d8411574) fix: parse errors correctly
* [`374ef5385`](https://github.com/siderolabs/talos/commit/374ef53853947811dc221d99751cf0e16294508c) test: submit verbose flag to e2e tests
* [`e1d38b6fe`](https://github.com/siderolabs/talos/commit/e1d38b6febf26fe31a6b9d6ed8f9b6bdba29aa3b) feat: show template URL in dashboard config URL tab
* [`45d7f0ce9`](https://github.com/siderolabs/talos/commit/45d7f0ce95454ce85c403fc493ddb97e4d478238) docs: fix the latest url
* [`96efbf147`](https://github.com/siderolabs/talos/commit/96efbf14769579d514ef9c75d01d9f44d276113a) docs: activate 1.4.0 docs by default
* [`8c1f515b1`](https://github.com/siderolabs/talos/commit/8c1f515b1b8e40bce42e2fc04755afe5bf8a56aa) feat: update Linux to 6.1.24
* [`8689bef5f`](https://github.com/siderolabs/talos/commit/8689bef5f10839091cf131edb6c8efad4ccba034) docs: update documentation for Talos 1.4
* [`a781dfb8e`](https://github.com/siderolabs/talos/commit/a781dfb8e3ded67edcb2a6a1048bfe76c6bd0d24) feat: update Kubernetes to 1.27.1
* [`a737dd83a`](https://github.com/siderolabs/talos/commit/a737dd83a4cd7549f85f8df0882f1c9a4446060d) chore: typo in `compatibility.ParseKubernetesVersion`
* [`f14928b0a`](https://github.com/siderolabs/talos/commit/f14928b0a9dd3d85664605f4f6a206236ea94614) fix: fix dashboard crash when a non-existent node is specified
* [`3e406d9b0`](https://github.com/siderolabs/talos/commit/3e406d9b07c0e67a2fb61e612bc3f378f3c35247) feat: update etcd to v3.5.8
* [`bd1cff3e8`](https://github.com/siderolabs/talos/commit/bd1cff3e83530b9b89b27d8083ea8f3f0cf6ede4) chore: remove Go buildid
* [`e31f7f50b`](https://github.com/siderolabs/talos/commit/e31f7f50b1b455beb98cd25859a44bbbccc1ff64) feat: update Kubernetes to 1.27.0
* [`aa3640d74`](https://github.com/siderolabs/talos/commit/aa3640d74ce2e3619476453381909fa3520eb87d) docs: update storage.md
* [`07bb61e60`](https://github.com/siderolabs/talos/commit/07bb61e60c53b267756dc97874b9c9554f2b1486) chore: module-sig-verify cleanup
* [`5e9d836c3`](https://github.com/siderolabs/talos/commit/5e9d836c3d075c3edb2d48b2868c31a1c963e2de) chore: add kernel module signtaure verification
* [`3cd1c6bb0`](https://github.com/siderolabs/talos/commit/3cd1c6bb0b83e5747a7356140a44b16deb4727e6) fix: send 'STOP' event on phase end
* [`5176d27dc`](https://github.com/siderolabs/talos/commit/5176d27dc566d8689bb305398da7250269ebe9a3) feat: update Kubernetes to 1.27.0-rc.1
* [`2c55550a6`](https://github.com/siderolabs/talos/commit/2c55550a66b49b49d8dc95b83516b7c0f8107300) fix: quote ISO kernel args for GRUB
* [`319d76e38`](https://github.com/siderolabs/talos/commit/319d76e38978406d8d37e89ada2c403969d6c972) fix: respect BROWSER=echo in client auth interceptor
* [`4e4ace839`](https://github.com/siderolabs/talos/commit/4e4ace839c0f558e7b00979fa4c64c32985aa3ce) chore: update Go to 1.20.3
* [`170f73899`](https://github.com/siderolabs/talos/commit/170f73899a3bf29e9c6f76fdc5e510be08edf4aa) fix: correctly parse static pod phase
* [`c3a595d5b`](https://github.com/siderolabs/talos/commit/c3a595d5b7d3c7c3091229caef6b2553416edb56) fix: improve action tracking post checks
* [`eb01edbc8`](https://github.com/siderolabs/talos/commit/eb01edbc8a0ef5810693afe450861d5b63877b72) fix: rework DHCP flow
* [`e095150a6`](https://github.com/siderolabs/talos/commit/e095150a6e34cbdc805a2cac85ec7f28f98629b4) test: bump CAPI components versions
</p>
</details>
### Changes since v1.5.0-alpha.2
<details><summary>9 commits</summary>
<p>
* [`d2f64af86`](https://github.com/siderolabs/talos/commit/d2f64af863e14b1d111bbeeaa6d9077aadaf6085) chore: disable cloud-images, pull in new kernel and gre module
* [`8edce4906`](https://github.com/siderolabs/talos/commit/8edce490639c213cd8c45989a5a87e3388179d37) docs: improve proxmox install guide
* [`c783458be`](https://github.com/siderolabs/talos/commit/c783458be0c90b779bcc2fe3c10e37fd3dfe01db) docs: typo dhcp -> dhcp
* [`003cbd161`](https://github.com/siderolabs/talos/commit/003cbd161196375edc8ee5033be62014eb88202e) docs: warn about secretboxEncryptionSecret in kubeadm migration guide
* [`786e86f5b`](https://github.com/siderolabs/talos/commit/786e86f5b8219ef37c5c6480d97c440cbbd53e30) refactor: rewrite the way Talos acquires the machine configuration
* [`5e13cafe5`](https://github.com/siderolabs/talos/commit/5e13cafe5b506039fdd652372b1d1f71a1c1c10b) feat: enforce kernel lockdown for UKI
* [`4d96d642f`](https://github.com/siderolabs/talos/commit/4d96d642fd9c462db2c084afee1428009d454a9e) feat: update default Kubernetes version to 1.28.0-beta.0
* [`170a73e16`](https://github.com/siderolabs/talos/commit/170a73e161eacb0e21ce95e7a7e406533552bf1d) chore: support creating qemu guest socket
* [`59ac38a6b`](https://github.com/siderolabs/talos/commit/59ac38a6bffe943fa634b124b8ec2a907f95a006) docs: add docs for installing azure ccm and csi
</p>
</details>
### Changes from siderolabs/crypto
<details><summary>2 commits</summary>
<p>
* [`8f77da3`](https://github.com/siderolabs/crypto/commit/8f77da30a5193d207a6660b562a273a06d73aae0) feat: add a method to load PEM key from file
* [`c03ff58`](https://github.com/siderolabs/crypto/commit/c03ff58af5051acb9b56e08377200324a3ea1d5e) feat: add a way to represent redacted x509 private keys
</p>
</details>
### Changes from siderolabs/discovery-api
<details><summary>1 commit</summary>
<p>
* [`5e3db3c`](https://github.com/siderolabs/discovery-api/commit/5e3db3c1a656ebdc717494e5384f10c7b11eef0f) chore: app optional ControlPlane data
</p>
</details>
### Changes from siderolabs/discovery-client
<details><summary>1 commit</summary>
<p>
* [`9ba5f03`](https://github.com/siderolabs/discovery-client/commit/9ba5f033a47d41448153962c5fe22db2d9a8a00c) chore: app optional ControlPlane data
</p>
</details>
### Changes from siderolabs/extras
<details><summary>3 commits</summary>
<p>
* [`f415aac`](https://github.com/siderolabs/extras/commit/f415aac20c245592612a02157d247cb2dd4a5d45) feat: update Go to 1.20.6
* [`a73d524`](https://github.com/siderolabs/extras/commit/a73d5243f443fd32376780bf2a4f97b08f28917c) feat: update Go to 1.20.5
* [`36c8ac4`](https://github.com/siderolabs/extras/commit/36c8ac4ab98300059acaad501c2adc8abd39179f) chore: update to Go 1.20.3
</p>
</details>
### Changes from siderolabs/gen
<details><summary>3 commits</summary>
<p>
* [`f9f5805`](https://github.com/siderolabs/gen/commit/f9f5805973d30fe6bbac2f4a79ad4197fe59970e) chore: bump rekres and add functions from exp
* [`b968d21`](https://github.com/siderolabs/gen/commit/b968d21c9671d97e54317f80cdf781d6f963e44b) feat: add `TryRecv` and `RecvWithContext` functions
* [`476dfea`](https://github.com/siderolabs/gen/commit/476dfeae70882e1ca6e5cfed3d6e12dc36841a26) feat: add foreach and clear to lazymap
</p>
</details>
### Changes from siderolabs/go-blockdevice
<details><summary>4 commits</summary>
<p>
* [`fbb01f7`](https://github.com/siderolabs/go-blockdevice/commit/fbb01f714bdc9c32ea3459345b730b1043ce10c0) fix: properly detect token not found error
* [`3e08968`](https://github.com/siderolabs/go-blockdevice/commit/3e089682439e885c6386f833e35728ce54daff44) fix: do not attach token to a key slot
* [`f2c419e`](https://github.com/siderolabs/go-blockdevice/commit/f2c419e81dcba3c5be007130f677d2075e2aec3c) feat: support LUKS token management
* [`076874a`](https://github.com/siderolabs/go-blockdevice/commit/076874a155ad44d764d25081125f950e8194d023) chore: resolve blockdevice symlinks
</p>
</details>
### Changes from siderolabs/go-debug
<details><summary>1 commit</summary>
<p>
* [`43d9100`](https://github.com/siderolabs/go-debug/commit/43d9100eba3a30ff0d7f1bed0058e6631243cc47) chore: allow enabling pprof manually
</p>
</details>
### Changes from siderolabs/go-kubernetes
<details><summary>2 commits</summary>
<p>
* [`69fea5b`](https://github.com/siderolabs/go-kubernetes/commit/69fea5b840fb51aa08e5fbf380fa924b9d444094) feat: support upgrades to Kubernetes 1.28
* [`5a3df5b`](https://github.com/siderolabs/go-kubernetes/commit/5a3df5b002d74ba9f4d773dc1278047481b1d4ba) fix: remove removed APIs for 1.27 upgrade
</p>
</details>
### Changes from siderolabs/go-loadbalancer
<details><summary>6 commits</summary>
<p>
* [`574126c`](https://github.com/siderolabs/go-loadbalancer/commit/574126cbf0e1e45a06cabaf602e5070dd7d441e2) chore: add 0.1ms tier and fix tiers
* [`5301800`](https://github.com/siderolabs/go-loadbalancer/commit/5301800a874e853d97f8e12195558f79c97c0beb) chore: fix logging and tests
* [`b23a173`](https://github.com/siderolabs/go-loadbalancer/commit/b23a1733aa9b303bda82175b4f5e9f8a4765a27b) chore: replace std log with zap
* [`1a2f374`](https://github.com/siderolabs/go-loadbalancer/commit/1a2f374df7804dffe683e8be90e9829f2dfb5e95) feat: add multi-tier scoring based for generic List
* [`56a27da`](https://github.com/siderolabs/go-loadbalancer/commit/56a27da7083139b71898f4f9207dc40088e8c815) chore: move to siderolabs/tcpproxy of inet.af/tcpproxy
* [`f3a0e24`](https://github.com/siderolabs/go-loadbalancer/commit/f3a0e2411e08eef9c79876f3dc6e09e770710379) fix: use SO_LINGER option when doing TCP healthchecks
</p>
</details>
### Changes from siderolabs/kms-client
<details><summary>3 commits</summary>
<p>
* [`50064b6`](https://github.com/siderolabs/kms-client/commit/50064b67ac73c0a3f6f89c6a44ef914711107df0) fix: pass context to the key handler in the server wrapper
* [`83e0a2e`](https://github.com/siderolabs/kms-client/commit/83e0a2ec6b06668940ec31d64491d9b8a630524b) feat: define API and add reference implementation for KMS server
* [`8c37ee8`](https://github.com/siderolabs/kms-client/commit/8c37ee83099a6563197c89166b0ea596eebf0598) Initial commit
</p>
</details>
### Changes from siderolabs/pkgs
<details><summary>41 commits</summary>
<p>
* [`fedfafa`](https://github.com/siderolabs/pkgs/commit/fedfafa77de930ae7945e16ace61c13568024ac5) feat: add thunderbolt/USB4 module
* [`17d5b94`](https://github.com/siderolabs/pkgs/commit/17d5b94cc7b3e9f9c86a9f5080dcc70f095659fe) feat: enable NET_IPGRE kernel config
* [`84cdfb6`](https://github.com/siderolabs/pkgs/commit/84cdfb6d270201b166dacdcd928669d028e12deb) feat: add 'zfs' package
* [`d0eaedc`](https://github.com/siderolabs/pkgs/commit/d0eaedcb5cd2510925e4609369e25c3e3572d5fe) feat: enable DM_RAID kernel config
* [`d5e0fad`](https://github.com/siderolabs/pkgs/commit/d5e0fad0d59dfb8d2386ab2ad6c7df749e0b9413) feat: update dependencies
* [`c644633`](https://github.com/siderolabs/pkgs/commit/c644633324ed1e56ab19f146c04ed3984736a88a) feat: enable multi-gen lru by default
* [`75696ba`](https://github.com/siderolabs/pkgs/commit/75696ba81581ef0f1af668db565a08950145e45d) feat: update Go to 1.20.6
* [`205cab6`](https://github.com/siderolabs/pkgs/commit/205cab6d0e6be2721c5338bef232e3345d3a299f) chore: feat use new sd-boot
* [`fb817fe`](https://github.com/siderolabs/pkgs/commit/fb817fe20789ca48895275e1877808a9206630dd) fix: enable USB attached SCSI driver on x86 systems
* [`43451e6`](https://github.com/siderolabs/pkgs/commit/43451e68a0ddf634b90c7c12cca9437faa52d183) chore: bump dependencies
* [`eca94f8`](https://github.com/siderolabs/pkgs/commit/eca94f8f1b9c3ceb62efb53fd1260d49ce17f1dd) feat: enable sriov
* [`5a8e8e5`](https://github.com/siderolabs/pkgs/commit/5a8e8e594248847bb606ca07b3ea29e187e20d26) feat: enable VMWARE/HYPERV vsockets
* [`edd725a`](https://github.com/siderolabs/pkgs/commit/edd725a0f9d07d39256d98a67be5dc4c56631078) chore: bump deps
* [`c0ac69b`](https://github.com/siderolabs/pkgs/commit/c0ac69b70cfac3cdcf100a35f6d766c5ae47d950) feat: enable CONFIG_NVME_{MULTIPATH|AUTH}
* [`f7cd916`](https://github.com/siderolabs/pkgs/commit/f7cd916b47975e61c6732079c1c5c4684dfb8c96) fix: bump drbd to 9.2.4
* [`a56d15a`](https://github.com/siderolabs/pkgs/commit/a56d15ad626b6e76a137636d6088361be9a73a9f) fix: copy missing `modules.*` files
* [`1eefa66`](https://github.com/siderolabs/pkgs/commit/1eefa664fc7c65491e956a6f403ada774e73a7d3) feat: build isb modem drivers as module
* [`a859f4f`](https://github.com/siderolabs/pkgs/commit/a859f4fb257e17fa19b1c10efcae594d33a86618) fix: build RDMA_RXE as a module
* [`5fb5e95`](https://github.com/siderolabs/pkgs/commit/5fb5e9517de9fe35e383b96e92fa873aa045a845) feat: bump dependencies
* [`39a64b2`](https://github.com/siderolabs/pkgs/commit/39a64b23e2c8689c44b9891b1e70149b8d003655) feat: update Linux to 6.1.31, add GENEVE for arm64
* [`97177be`](https://github.com/siderolabs/pkgs/commit/97177be803cc91c8fabccfec575b7d920bc78c38) feat: update Linux to 6.1.30
* [`b1f9d4e`](https://github.com/siderolabs/pkgs/commit/b1f9d4e717fbd0132b820d45c226ca643d7f577e) chore: prevent unsigned kexec with secureboot
* [`9232a42`](https://github.com/siderolabs/pkgs/commit/9232a425b85b1058cd38eab30304f6cf243ab32c) feat: add reproducibility pipelines
* [`702d7a7`](https://github.com/siderolabs/pkgs/commit/702d7a7e90099d8fdc9cc4ba50e86c8ba6e91d77) chore: bump deps
* [`7958db1`](https://github.com/siderolabs/pkgs/commit/7958db1549a7c7560eeeb8f9c06d3be9487d8804) chore: copy over sd-boot and sd-stub from tools
* [`813b3c3`](https://github.com/siderolabs/pkgs/commit/813b3c3d3276d0d9156919307e9ffe521925d40b) chore: revert xfsprogs
* [`0cc78ab`](https://github.com/siderolabs/pkgs/commit/0cc78ab82ce920c8fa5654c73738050107e190bb) chore: bump kernel to 6.1.28
* [`70189e3`](https://github.com/siderolabs/pkgs/commit/70189e3df555fed4afade93798d72cd31aad99c5) chore: bump deps
* [`c5d3bf1`](https://github.com/siderolabs/pkgs/commit/c5d3bf1985b49e688d29d06db6730834f65ee480) feat: add sd-stub and sd-boot
* [`30a7ac2`](https://github.com/siderolabs/pkgs/commit/30a7ac2974fb7580e83819c76502fde77d777ea0) feat: update Linux 6.1.27, containerd 1.6.21
* [`fbc6ee5`](https://github.com/siderolabs/pkgs/commit/fbc6ee55b6ffae44c117255901ab0fbecae79cc3) chore: bump deps
* [`82b9489`](https://github.com/siderolabs/pkgs/commit/82b9489b88b108f144b45fb55432576bfd767f91) chore: bump dependencies
* [`f37e520`](https://github.com/siderolabs/pkgs/commit/f37e5205cf10fe10296e86565fa018d149f5d8c4) feat: update Linux to 6.1.25
* [`3920b16`](https://github.com/siderolabs/pkgs/commit/3920b163a5c6a6d7c7969155a909a7b2122e65f6) feat: add multi-gen LRU kernel support
* [`988f1ec`](https://github.com/siderolabs/pkgs/commit/988f1ecf95536fb259cbd79e044a556728bc7332) feat: update Linux to 6.1.24
* [`5327d12`](https://github.com/siderolabs/pkgs/commit/5327d1263680f76706ea667906ca08222c8398da) fix: remove FB_NVIDIA drivers, Linux 6.1.23
* [`4eae958`](https://github.com/siderolabs/pkgs/commit/4eae958770573613bc29568d130be7aaa775e530) chore: copy over the kernel signing public key
* [`174f8fc`](https://github.com/siderolabs/pkgs/commit/174f8fc9c80d871f1c03ea0a53dc8b6eb7112ccf) chore: update Go to 1.20.3
* [`41629b0`](https://github.com/siderolabs/pkgs/commit/41629b03e82bfb77623a812000ef8e98d15d56fa) chore: reorder pkgs for better kernel caching
* [`b483a6b`](https://github.com/siderolabs/pkgs/commit/b483a6b01f539b0da13ca09882015044bff24e41) feat: build 'snp.efi' for iPXE
* [`fb853ff`](https://github.com/siderolabs/pkgs/commit/fb853ff6b1194cdc1f2412c776347cf4b55c3336) feat: update containerd to 1.6.20
</p>
</details>
### Changes from siderolabs/tools
<details><summary>20 commits</summary>
<p>
* [`dc7dd9e`](https://github.com/siderolabs/tools/commit/dc7dd9e5b949f6f5d7626f11cb3b001526e8d1de) chore: remove libseccomp
* [`e27c249`](https://github.com/siderolabs/tools/commit/e27c249c3213af6d12be4fb440a8f896c8e1b3d4) feat: update Go to 1.20.6
* [`9b6d512`](https://github.com/siderolabs/tools/commit/9b6d5123fa1e28160019a4b6e8b0f04482c49dc0) feat: use systemd 254-rc1
* [`cd3b692`](https://github.com/siderolabs/tools/commit/cd3b692b0cf5c663548cbe75db43036e11ee1014) chore: bump deps
* [`c1027a6`](https://github.com/siderolabs/tools/commit/c1027a63d058b77f6cce7351fa7b63d4c94883ad) chore: remove sbsign
* [`e0c76c0`](https://github.com/siderolabs/tools/commit/e0c76c096d06ef11afdb54287d5f15add108399b) chore: bump dependencies
* [`7d0cd58`](https://github.com/siderolabs/tools/commit/7d0cd58b34bba6b9415db5e39bed351e7f00d44d) feat: update Go to 1.20.5
* [`150efc2`](https://github.com/siderolabs/tools/commit/150efc22508043bfadc9d84a8c3c5fee6c2aac5f) chore: remove non needed tools
* [`88ebb40`](https://github.com/siderolabs/tools/commit/88ebb40dd348b6c9e4dc5551b616e4a1892b4e42) feat: add swtpm
* [`4c5d7fe`](https://github.com/siderolabs/tools/commit/4c5d7feb88dcbae2f7bf45f51f9e5e1ba339abac) chore: use same source epoch everywhere
* [`2e46e5b`](https://github.com/siderolabs/tools/commit/2e46e5be764f8180a0762a5ab080ccff04534a8a) feat: add reproducibility pipelines
* [`c6a41b6`](https://github.com/siderolabs/tools/commit/c6a41b6c5108d676f8573d3dd47ee29ae46e5cc0) fix: add sd-stub assertion patch
* [`d2dde48`](https://github.com/siderolabs/tools/commit/d2dde48f72343aa3c541336f5319b8e649e80c87) chore: bump deps
* [`8e45ad7`](https://github.com/siderolabs/tools/commit/8e45ad75ea78e353ca3eae21b18da9a42d1edf49) feat: add sbsign
* [`271c4a6`](https://github.com/siderolabs/tools/commit/271c4a66b6987d9de2c0d1d69891b5ff277ebd43) feat: add sd-tools
* [`eedc294`](https://github.com/siderolabs/tools/commit/eedc294967d415cca40d4c427d3521cd198661d7) chore: bump deps
* [`81b09a5`](https://github.com/siderolabs/tools/commit/81b09a5ab204f16306c980eeff518a0d1a37ddf2) feat: add libcap and gnuefi
* [`47b0fd3`](https://github.com/siderolabs/tools/commit/47b0fd3e364d4fbcfffe10965f740db7acd82f70) chore: bump go to 1.20.4
* [`ff4cf2b`](https://github.com/siderolabs/tools/commit/ff4cf2beabab310365ad9887abb6234570f5092a) chore: bump deps
* [`1563556`](https://github.com/siderolabs/tools/commit/1563556b8f8fdf20d8aa58ac5340104c7ffe732e) feat: update Go to 1.20.3
</p>
</details>
### Dependency Changes
* **github.com/BurntSushi/toml** v1.2.1 -> v1.3.2
* **github.com/aws/aws-sdk-go** v1.44.232 -> v1.44.304
* **github.com/beevik/ntp** v0.3.0 -> v1.2.0
* **github.com/benbjohnson/clock** v1.1.0 -> v1.3.5
* **github.com/cenkalti/backoff/v4** v4.2.0 -> v4.2.1
* **github.com/containerd/containerd** v1.6.19 -> v1.6.21
* **github.com/containerd/typeurl/v2** v2.1.1 **_new_**
* **github.com/containernetworking/plugins** v1.2.0 -> v1.3.0
* **github.com/cosi-project/runtime** v0.3.0 -> v0.3.1-alpha.8
* **github.com/docker/distribution** v2.8.1 -> v2.8.2
* **github.com/docker/docker** v23.0.2 -> v24.0.4
* **github.com/ecks/uefi** caef65d070eb **_new_**
* **github.com/emicklei/dot** v1.4.2 -> v1.5.0
* **github.com/foxboron/go-uefi** 32187aa193d0 **_new_**
* **github.com/google/go-tpm** v0.9.0 **_new_**
* **github.com/hashicorp/go-envparse** v0.1.0 **_new_**
* **github.com/hetznercloud/hcloud-go** v1.41.0 -> v1.48.0
* **github.com/insomniacslk/dhcp** 74ae03f2425e -> 5648422c16cd
* **github.com/jsimonetti/rtnetlink** v1.3.1 -> v1.3.4
* **github.com/mattn/go-isatty** v0.0.18 -> v0.0.19
* **github.com/mdlayher/ethtool** ba3b4bc2e02c -> v0.1.0
* **github.com/mdlayher/genetlink** v1.3.1 -> v1.3.2
* **github.com/mdlayher/netlink** v1.7.1 -> v1.7.2
* **github.com/mdlayher/netx** c711c2f8512f -> 7e21880baee8
* **github.com/nberlee/go-netstat** v0.1.1 -> v0.1.2
* **github.com/opencontainers/go-digest** v1.0.0 **_new_**
* **github.com/opencontainers/image-spec** v1.1.0-rc2 -> v1.1.0-rc4
* **github.com/packethost/packngo** v0.29.0 -> v0.30.0
* **github.com/prometheus/procfs** v0.9.0 -> v0.11.0
* **github.com/rivo/tview** 281d14d896d7 -> 6cc0565babaf
* **github.com/rs/xid** v1.4.0 -> v1.5.0
* **github.com/scaleway/scaleway-sdk-go** v1.0.0-beta.15 -> v1.0.0-beta.19
* **github.com/siderolabs/crypto** v0.4.0 -> v0.4.1
* **github.com/siderolabs/discovery-api** v0.1.2 -> v0.1.3
* **github.com/siderolabs/discovery-client** v0.1.4 -> v0.1.5
* **github.com/siderolabs/extras** v1.4.0-1-g9b07505 -> v1.5.0-alpha.0-2-gf415aac
* **github.com/siderolabs/gen** v0.4.3 -> v0.4.5
* **github.com/siderolabs/go-blockdevice** v0.4.4 -> v0.4.6
* **github.com/siderolabs/go-debug** v0.2.2 -> v0.2.3
* **github.com/siderolabs/go-kubernetes** v0.2.0 -> v0.2.2
* **github.com/siderolabs/go-loadbalancer** v0.2.1 -> v0.3.2
* **github.com/siderolabs/kms-client** v0.1.0 **_new_**
* **github.com/siderolabs/pkgs** v1.4.1-5-ga333a84 -> v1.5.0-alpha.0-40-gfedfafa
* **github.com/siderolabs/talos/pkg/machinery** v1.4.0 -> v1.5.0-alpha.2
* **github.com/siderolabs/tools** v1.4.0-1-g955aabc -> v1.5.0-alpha.0-19-gdc7dd9e
* **github.com/spf13/cobra** v1.6.1 -> v1.7.0
* **github.com/stretchr/testify** v1.8.2 -> v1.8.4
* **github.com/vmware-tanzu/sonobuoy** v0.56.16 -> v0.56.17
* **github.com/vmware/govmomi** v0.30.4 -> v0.30.6
* **go.etcd.io/etcd/api/v3** v3.5.8 -> v3.5.9
* **go.etcd.io/etcd/client/pkg/v3** v3.5.8 -> v3.5.9
* **go.etcd.io/etcd/client/v3** v3.5.8 -> v3.5.9
* **go.etcd.io/etcd/etcdutl/v3** v3.5.8 -> v3.5.9
* **golang.org/x/net** v0.8.0 -> v0.12.0
* **golang.org/x/sync** v0.1.0 -> v0.3.0
* **golang.org/x/sys** v0.6.0 -> v0.10.0
* **golang.org/x/term** v0.6.0 -> v0.10.0
* **golang.org/x/text** v0.11.0 **_new_**
* **golang.zx2c4.com/wireguard/wgctrl** 9c5414ab4bde -> 925a1e7659e6
* **google.golang.org/grpc** v1.54.0 -> v1.56.2
* **google.golang.org/protobuf** v1.30.0 -> v1.31.0
* **k8s.io/api** v0.27.1 -> v0.28.0-alpha.4
* **k8s.io/apimachinery** v0.27.1 -> v0.28.0-alpha.4
* **k8s.io/apiserver** v0.27.1 -> v0.28.0-alpha.4
* **k8s.io/client-go** v0.27.1 -> v0.28.0-alpha.4
* **k8s.io/component-base** v0.27.1 -> v0.28.0-alpha.4
* **k8s.io/cri-api** v0.27.1 -> v0.28.0-alpha.4
* **k8s.io/klog/v2** v2.90.1 -> v2.100.1
* **k8s.io/kubectl** v0.27.1 -> v0.28.0-alpha.4
* **k8s.io/kubelet** v0.27.1 -> v0.28.0-alpha.4
* **kernel.org/pub/linux/libs/security/libcap/cap** v1.2.68 -> v1.2.69
Previous release can be found at [v1.4.0](https://github.com/siderolabs/talos/releases/tag/v1.4.0)
## [Talos 1.5.0-alpha.2](https://github.com/siderolabs/talos/releases/tag/v1.5.0-alpha.2) (2023-07-20)
Welcome to the v1.5.0-alpha.2 release of Talos!
*This is a pre-release of Talos*
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
### Extension Services
Talos now supports setting `environmentFile` for an extension service container spec. Refer: https://www.talos.dev/v1.5/advanced/extension-services/#container
The extension waits for the file to be present before starting the service.
### Predictable Network Interface Names
Starting with version Talos 1.5, network interfaces are renamed to [predictable names](https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/)
same way as `systemd` does that in other Linux distributions.
The naming schema `enx78e7d1ea46da` (based on MAC addresses) is enabled by default, the order of interface naming decisions is:
* firmware/BIOS provided index numbers for on-board devices (example: `eno1`)
* firmware/BIOS provided PCI Express hotplug slot index numbers (example: `ens1`)
* physical/geographical location of the connector of the hardware (example: `enp2s0`)
* interfaces's MAC address (example: `enx78e7d1ea46da`)
The predictable network interface names features can be disabled by specifying `net.ifnames=0` in the kernel command line.
Talos automatically adds the `net.ifnames=0` kernel argument when upgrading from Talos versions before 1.5.
This change doesn't affect "cloud" platforms, like AWS, as Talos automatically adds `net.ifnames=0` to the kernel command line.
### Network KMS Disk Encryption
Talos now supports new type of encryption keys which are sealed/unsealed with an external KMS server:
systemDiskEncryption: ephemeral: keys: - kms: endpoint: https://1.2.3.4:443 slot: 0
gRPC API definitions and a simple reference implementation of the KMS server can be found in this
[repository](https://github.com/siderolabs/kms-client/blob/main/cmd/kms-server/main.go).
### KubePrism - Kubernetes API Server In-Cluster Load Balancer
Talos now supports configuring the KubePrism - Kubernetes API Server in-cluster load balancer with machine config
`features.kubePrism.port` and `features.kubePrism.enabled` fields.
If enabled, KubePrism binds to `localhost` and runs on the same port on every machine in the cluster.
The default value for KubePrism endpoint is https://localhost:7445.
The KubePrism is used by the `kubelet`, `kube-scheduler`, `kube-controller-manager`
and `kube-proxy` by default and can be passed to the CNIs like Cilium and Calico.
The KubePrism provides access to the Kubernetes API endpoint even if the external loadbalancer
is not healthy, provided that the worker nodes can reach to the controlplane machine addresses directly.
### Machine Config option `.machine.install.bootloader`
The `.machine.install.bootloader` option in the machine config is deprecated and will be removed in Talos 1.6.
This was a no-op for a long time. The bootloader is always installed.
### XFS Quota
Talos 1.5+ enables XFS project quota support by default, also enabling by default
kubelet feature gate `LocalStorageCapacityIsolationFSQuotaMonitoring` to use xfs quotas
to monitor volume usage instead of `du`.
This feature is controlled by the `.machine.features.diskQuotaSupport` field in the machine config,
it is set to true for new clusters.
When upgrading from a previous version, the feature can be enabled by setting the field to true.
On the first mount of a volume, the quota information will be recalculated, which may take some time.
### RDMA/RoCE support
Talos no longer loads by default `rdma_rxe` Linux driver, which is required for RoCE support.
If the driver is required, it can be enabled by specifying `rdma_rxe` in the `.machine.kernel.modules` field in the machine config.
### SecureBoot
Talos now supports generating a custom iso that can be used with SecureBoot. Key generation and enrolling has to be done manually.
### `talosctl image` Command
A new set of commands was introduced to manage container images in the CRI:
* `talosctl image list` shows list of available images
* `talosctl image pull` allows to pre-pull an image into the CRI
Both new commands accept `--namespace` flag with two possible values:
* `cri` (default): images managed by the CRI (Kubernetes workloads)
* `system`: images managed by Talos (`etcd` and `kubelet`)
talosctl images CommandThe command talosctl images was renamed to talosctl image default.
The backward-compatible alias is kept in Talos 1.5, but it will be dropped in Talos 1.6.
Talos now supports encrypting STATE/EPHEMERAL with keys bound to a TPM device. The TPM device must be TPM2.0 compatible. This is ideally supported when booting with new Talos SecureBoot UKI ISOs/Metal images. This feature would still work if SecureBoot is not enabled for UKI images, but not recommended since there is no way to verify the trust of the bootloader.
Example machine config:
systemDiskEncryption:
ephemeral:
keys:
- slot: 0
tpm: {}
state:
keys:
- slot: 0
tpm: {}
Talos is built with Go 1.20.6.
talosctl upgrade-k8s Image Pre-pullingThe command talosctl upgrade-k8s now by default pre-pulls images for Kubernetes controlplane components
and kubelet. This provides an early check for missing images, and minimizes downtime during Kubernetes
rolling component update.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →