github.com/siderolabs/talos

Welcome to the v1.5.0-alpha.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Kubernetes API Server In-Cluster Load Balancer

Talos now supports configuring the Kubernetes API Server in-cluster load balancer with machine config features.apiServerBalancerSupport.port and features.apiServerBalancerSupport.enabled fields.

If enabled, the loadbalancer binds to localhost and runs on the same port on every machine in the cluster. The default value for loadbalancer endpoint is https://localhost:7445.

The in-cluster loadbalancer endpoint is used by the kubelet, kube-scheduler, kube-controller-manager and kube-proxy by default and can be passed to the CNIs like Cilium and Calico.

The in-cluster loadbalancer provides access to the Kubernetes API endpoint even if the external loadbalancer is not healthy, provided that the worker nodes can reach to the controlplane machine addresses directly.

Predictable Network Interface Names

Starting with version Talos 1.5, network interfaces are renamed to predictable names same way as systemd does that in other Linux distributions.

The naming schema enx78e7d1ea46da (based on MAC addresses) is enabled by default, the order of interface naming decisions is:

• firmware/BIOS provided index numbers for on-board devices (example: eno1)
• firmware/BIOS provided PCI Express hotplug slot index numbers (example: ens1)
• physical/geographical location of the connector of the hardware (example: enp2s0)
• interfaces's MAC address (example: enx78e7d1ea46da)

The predictable network interface names features can be disabled by specifying net.ifnames=0 in the kernel command line. Talos automatically adds the net.ifnames=0 kernel argument when upgrading from Talos versions before 1.5.

This change doesn't affect "cloud" platforms, like AWS, as Talos automatically adds net.ifnames=0 to the kernel command line.

Machine Config option .machine.install.bootloader

The .machine.install.bootloader option in the machine config is deprecated and will be removed in Talos 1.6. This was a no-op for a long time. The bootloader is always installed.

XFS Quota

Talos 1.5+ enables XFS project quota support by default, also enabling by default kubelet feature gate LocalStorageCapacityIsolationFSQuotaMonitoring to use xfs quotas to monitor volume usage instead of du.

This feature is controlled by the .machine.features.diskQuotaSupport field in the machine config, it is set to true for new clusters.

When upgrading from a previous version, the feature can be enabled by setting the field to true. On the first mount of a volume, the quota information will be recalculated, which may take some time.

RDMA/RoCE support

Talos no longer loads by default rdma_rxe Linux driver, which is required for RoCE support. If the driver is required, it can be enabled by specifying rdma_rxe in the .machine.kernel.modules field in the machine config.

SecureBoot

Talos now supports generating a custom iso that can be used with SecureBoot. Key generation and enrolling has to be done manually.

Component Updates

• Linux: 6.1.35
• containerd: 1.6.21
• runc: 1.1.7
• etcd: 3.5.9
• Kubernetes: 1.27.3
• Flannel: 0.22.0

Talos is built with Go 1.20.5.

Contributors

• Andrey Smirnov
• Noel Georgi
• Dmitriy Matrenichev
• Utku Ozdemir
• Christian Rolland
• Nanfei Chen
• Spencer Smith
• Steve Francis
• Alex Corcoles
• Alex Corcoles
• Alex Lubbock
• Budiman Jojo
• DJAlPee
• Eirik Askheim
• Henk Kraal
• Michael A. Davis
• Michael Fornaro
• Nico Berlee
• Niklas Wik
• Piotr Maksymiuk
• Ricky Sadowski
• Roee Klinger
• Thomas Perronin
• Walt Chen
• bdronneau

Changes

<details><summary>133 commits</summary> <p>

• 8daf432b2 chore: bump deps
• e3f3f5794 feat: implement revert for sd-boot
• d8b0903d7 docs: vagrant setup document fix
• fe0f46980 feat: implement secure boot from disk
• 445f5ad54 feat: support API server load balancer
• 19bc223de refactor: bootloader interface, labels
• 665702ddd chore: fix cilium e2e tests
• 71a548d18 chore: generic boootloader implementation
• e9dbc9311 test: bump versions for upgrade tests
• 0a99965ef refactor: replace uncordonNode with controllers
• e858bca3a test: fix cilium integration tests
• 455328d05 fix: allow time skew for generated kubeconfig
• 3ae05648a fix: usage of custom kernels
• 0797b0d16 chore: add a pipeline to test cloud-images step without a release
• e5a36268b docs: include allowSchedulingOnControlPlanes on talosctl gen config output
• c74d93728 chore: bump github.com/cosi-project/runtime
• dbaf5c699 refactor: task labelControlPlane into controllers
• 1865a0c29 chore: modify some usages that are not recommended
• 3816318b9 chore: wrap config.Provider in atomic wrapper
• d04cf1978 chore: clean up unnecessary self assignment
• a34a94898 fix: copy missing modules.* files
• f5e3272fc refactor: task 'updateBootLoader' as controller
• e7be6ee7c refactor: make event log streaming fully reactive
• aef2192a6 chore: use fixed module list
• c719aa231 fix: allow http:// for discovery service URL
• 39134d8d5 chore: fix cron pipeline
• a61dcdbbd fix: don't load RDMA over Ethernet driver by default
• aac441f61 chore: update Go to 1.20.5, bump dependencies
• 1c0c7933d chore: cleanup partition code
• 31b988281 docs: add some words about certifcates
• e912c0dfc chore: use go-blockdevice for zeroing partitions
• e6dde8ffc feat: add network chaos to qemu development environment
• 47986cb79 chore: unify kexec phase
• 3a865370f feat: qemu secureboot
• 5dab45e86 refactor: allow kmsg log streaming to be reconfigured on the fly
• 8a02ecd4c chore: add endpoints balancer controller
• 423a31ac9 chore: deprectae bootloader installer option
• cdfece7d6 chore: optimize image compression
• bfc341937 chore: add default console args
• 2749aeeda feat: add support for multi-doc strategic merge patching
• 3f68485e4 feat: add uki iso generation
• bab484a40 feat: use stable network interface names
• 196dfb99b fix: do not probe kernel args in dashboard if not needed
• 8c071b579 fix: skip DHCP RENEW if server IP in the lease is all zeroes
• badbc51e6 refactor: rewrite code to include preliminary support for multi-doc
• ecce29dee fix: upgrade-k8s use internal IP first, external IP fallback
• 3c64a5ffb chore: optimize image generation time
• 2292f36d9 chore: registry.k8s.io for coredns image
• f2b258b37 docs: document talosctl version for upgrades
• a0773f783 chore: add ukify Go script
• b69e38d1f chore: bump dependencies
• adce65103 docs: add piraeus/drbd to storage documentation
• a982cabe7 docs: link support matrix in k8s update doc
• 1fb29a56a fix: fail quickly if upgrade-k8s is used with multiple nodes
• 51d931c47 chore: faster dev cycle
• dc6764871 refactor: move around config interfaces, make RawV1Alpha1 typed
• ea9a97dba fix: fall back to external IP when discovering nodes in upgrade-k8s
• 0bb7e8a5c refactor: split config.Provider into Config & Container
• 85d8a1619 chore: bump deps
• 39b7a56f0 chore: use 8GiB instead of 10GiB for cloud images
• ff11fd39c fix: race with udevd and mountUserDisks
• c3fabb982 chore: update default image sizes to 10GB for all "cloud" images
• 10155c390 feat: enable xfs project quota support, kubelet feature
• eba818564 release(v1.5.0-alpha.0): prepare release
• 383471c3e feat: update default Kubernetes to v1.27.2
• 8f68d1abe chore: bump deps
• e0c1585d3 feat: create azure community gallery image version on release
• dd8336c9e fix: refresh kubelet self-issued serving certificates
• bb02dd263 chore: drop deprecated stuff for Talos 1.5
• 61cad8673 chore: bump deps
• 01dfd3af7 feat: update etcd to v3.5.9
• aa65fbb8a chore: update KUBECTL_URL to reflect the community bucket
• cc3128d94 chore: bump kernel to 6.1.28
• 97fffaf78 chore: use ctest.UpdateWithConflicts instead of plain UpdateWithConflicts
• 3b36993b9 fix: rlimit nofile test
• 45e6e27af chore: bump runtime
• 4f720d465 fix: revert: set rlimit explicitly in wrapperd
• a2565f674 fix: set rlimit explicitly in wrapperd
• cdfc242b8 chore: re-enable Go buildid
• e67f3f5c5 feat: linux 6.1.27, containerd 1.6.21, go 1.20.4
• 55ae59a0a fix: properly skip/cleanup controlplane configs for workers
• 64eade9bd chore: clean up unused constant
• 62c6e9655 feat: introduce siderolink config resource & reconnect
• 860002c73 fix: don't reload control plane pods on cert SANs changes
• d43c61e80 fix: enforce nolock option for all NFS mounts by default
• 339986db9 fix: inhibit timer to follow kubelet timer
• cbf6dc100 fix: set timeout for unmount calls
• b58f913d5 fix: set the static pod priority as values
• f8a7a5b6b docs: add information about KubeSpan ports and topology
• 2bad74d64 docs: add how to on scaling down
• 7442ff8b0 chore: fix typos inteface -> interface (docs and tests)
• d4e94f7a1 fix: add back required TARGETARCH for installer
• e6fffda01 chore: linux 6.1.26, runc 1.1.7
• 344746ae2 fix: bump max inhibit delay to 20 min
• d9bdea2b5 chore: fork docs and compatibility modules for Talos 1.5
• 3d99610fc docs: document building, verifying image and process caps
• 014008ea2 fix: udevd rules trigger
• 9b36bb613 feat: update Linux to 6.1.25, fix virtio on arm64
• 08ec66c55 feat: clean up (garbage collect) system images which are not referenced
• b097efcde fix: display correct number of machines on dashboard
• cad43f0ad chore: remove k8s master label
• e296a566e fix: support kernel userspace module loading
• 103f0ffdd feat: add startup probes to controller-manager and scheduler
• 5a1ae8aae chore: bump dependences
• ec8c8dbaf chore: fix container image reproducibility
• f661d8487 fix: allow talosctl cp to handle special files in /proc
• 2d824b563 fix: do not show control plane status for workers on dashboard
• e5491ddad docs: update documentation for nocloud
• 7a004a6f7 fix: parse errors correctly
• 374ef5385 test: submit verbose flag to e2e tests
• e1d38b6fe feat: show template URL in dashboard config URL tab
• 45d7f0ce9 docs: fix the latest url
• 96efbf147 docs: activate 1.4.0 docs by default
• 8c1f515b1 feat: update Linux to 6.1.24
• 8689bef5f docs: update documentation for Talos 1.4
• a781dfb8e feat: update Kubernetes to 1.27.1
• a737dd83a chore: typo in compatibility.ParseKubernetesVersion
• f14928b0a fix: fix dashboard crash when a non-existent node is specified
• 3e406d9b0 feat: update etcd to v3.5.8
• bd1cff3e8 chore: remove Go buildid
• e31f7f50b feat: update Kubernetes to 1.27.0
• aa3640d74 docs: update storage.md
• 07bb61e60 chore: module-sig-verify cleanup
• 5e9d836c3 chore: add kernel module signtaure verification
• 3cd1c6bb0 fix: send 'STOP' event on phase end
• 5176d27dc feat: update Kubernetes to 1.27.0-rc.1
• 2c55550a6 fix: quote ISO kernel args for GRUB
• 319d76e38 fix: respect BROWSER=echo in client auth interceptor
• 4e4ace839 chore: update Go to 1.20.3
• 170f73899 fix: correctly parse static pod phase
• c3a595d5b fix: improve action tracking post checks
• eb01edbc8 fix: rework DHCP flow
• e095150a6 test: bump CAPI components versions </p> </details>

Changes since v1.5.0-alpha.0

<details><summary>63 commits</summary> <p>

• 8daf432b2 chore: bump deps
• e3f3f5794 feat: implement revert for sd-boot
• d8b0903d7 docs: vagrant setup document fix
• fe0f46980 feat: implement secure boot from disk
• 445f5ad54 feat: support API server load balancer
• 19bc223de refactor: bootloader interface, labels
• 665702ddd chore: fix cilium e2e tests
• 71a548d18 chore: generic boootloader implementation
• e9dbc9311 test: bump versions for upgrade tests
• 0a99965ef refactor: replace uncordonNode with controllers
• e858bca3a test: fix cilium integration tests
• 455328d05 fix: allow time skew for generated kubeconfig
• 3ae05648a fix: usage of custom kernels
• 0797b0d16 chore: add a pipeline to test cloud-images step without a release
• e5a36268b docs: include allowSchedulingOnControlPlanes on talosctl gen config output
• c74d93728 chore: bump github.com/cosi-project/runtime
• dbaf5c699 refactor: task labelControlPlane into controllers
• 1865a0c29 chore: modify some usages that are not recommended
• 3816318b9 chore: wrap config.Provider in atomic wrapper
• d04cf1978 chore: clean up unnecessary self assignment
• a34a94898 fix: copy missing modules.* files
• f5e3272fc refactor: task 'updateBootLoader' as controller
• e7be6ee7c refactor: make event log streaming fully reactive
• aef2192a6 chore: use fixed module list
• c719aa231 fix: allow http:// for discovery service URL
• 39134d8d5 chore: fix cron pipeline
• a61dcdbbd fix: don't load RDMA over Ethernet driver by default
• aac441f61 chore: update Go to 1.20.5, bump dependencies
• 1c0c7933d chore: cleanup partition code
• 31b988281 docs: add some words about certifcates
• e912c0dfc chore: use go-blockdevice for zeroing partitions
• e6dde8ffc feat: add network chaos to qemu development environment
• 47986cb79 chore: unify kexec phase
• 3a865370f feat: qemu secureboot
• 5dab45e86 refactor: allow kmsg log streaming to be reconfigured on the fly
• 8a02ecd4c chore: add endpoints balancer controller
• 423a31ac9 chore: deprectae bootloader installer option
• cdfece7d6 chore: optimize image compression
• bfc341937 chore: add default console args
• 2749aeeda feat: add support for multi-doc strategic merge patching
• 3f68485e4 feat: add uki iso generation
• bab484a40 feat: use stable network interface names
• 196dfb99b fix: do not probe kernel args in dashboard if not needed
• 8c071b579 fix: skip DHCP RENEW if server IP in the lease is all zeroes
• badbc51e6 refactor: rewrite code to include preliminary support for multi-doc
• ecce29dee fix: upgrade-k8s use internal IP first, external IP fallback
• 3c64a5ffb chore: optimize image generation time
• 2292f36d9 chore: registry.k8s.io for coredns image
• f2b258b37 docs: document talosctl version for upgrades
• a0773f783 chore: add ukify Go script
• b69e38d1f chore: bump dependencies
• adce65103 docs: add piraeus/drbd to storage documentation
• a982cabe7 docs: link support matrix in k8s update doc
• 1fb29a56a fix: fail quickly if upgrade-k8s is used with multiple nodes
• 51d931c47 chore: faster dev cycle
• dc6764871 refactor: move around config interfaces, make RawV1Alpha1 typed
• ea9a97dba fix: fall back to external IP when discovering nodes in upgrade-k8s
• 0bb7e8a5c refactor: split config.Provider into Config & Container
• 85d8a1619 chore: bump deps
• 39b7a56f0 chore: use 8GiB instead of 10GiB for cloud images
• ff11fd39c fix: race with udevd and mountUserDisks
• c3fabb982 chore: update default image sizes to 10GB for all "cloud" images
• 10155c390 feat: enable xfs project quota support, kubelet feature </p> </details>

Changes from siderolabs/discovery-api

<details><summary>1 commit</summary> <p>

• 5e3db3c chore: app optional ControlPlane data </p> </details>

Changes from siderolabs/discovery-client

<details><summary>1 commit</summary> <p>

• 9ba5f03 chore: app optional ControlPlane data </p> </details>

Changes from siderolabs/extras

<details><summary>2 commits</summary> <p>

• a73d524 feat: update Go to 1.20.5
• 36c8ac4 chore: update to Go 1.20.3 </p> </details>

Changes from siderolabs/gen

<details><summary>3 commits</summary> <p>

• f9f5805 chore: bump rekres and add functions from exp
• b968d21 feat: add TryRecv and RecvWithContext functions
• 476dfea feat: add foreach and clear to lazymap </p> </details>

Changes from siderolabs/go-blockdevice

<details><summary>1 commit</summary> <p>

• 076874a chore: resolve blockdevice symlinks </p> </details>

Changes from siderolabs/go-kubernetes

<details><summary>1 commit</summary> <p>

• 5a3df5b fix: remove removed APIs for 1.27 upgrade </p> </details>

Changes from siderolabs/go-loadbalancer

<details><summary>5 commits</summary> <p>

• 5301800 chore: fix logging and tests
• b23a173 chore: replace std log with zap
• 1a2f374 feat: add multi-tier scoring based for generic List
• 56a27da chore: move to siderolabs/tcpproxy of inet.af/tcpproxy
• f3a0e24 fix: use SO_LINGER option when doing TCP healthchecks </p> </details>

Changes from siderolabs/pkgs

<details><summary>29 commits</summary> <p>

• edd725a chore: bump deps
• c0ac69b feat: enable CONFIG_NVME_{MULTIPATH|AUTH}
• f7cd916 fix: bump drbd to 9.2.4
• a56d15a fix: copy missing modules.* files
• 1eefa66 feat: build isb modem drivers as module
• a859f4f fix: build RDMA_RXE as a module
• 5fb5e95 feat: bump dependencies
• 39a64b2 feat: update Linux to 6.1.31, add GENEVE for arm64
• 97177be feat: update Linux to 6.1.30
• b1f9d4e chore: prevent unsigned kexec with secureboot
• 9232a42 feat: add reproducibility pipelines
• 702d7a7 chore: bump deps
• 7958db1 chore: copy over sd-boot and sd-stub from tools
• 813b3c3 chore: revert xfsprogs
• 0cc78ab chore: bump kernel to 6.1.28
• 70189e3 chore: bump deps
• c5d3bf1 feat: add sd-stub and sd-boot
• 30a7ac2 feat: update Linux 6.1.27, containerd 1.6.21
• fbc6ee5 chore: bump deps
• 82b9489 chore: bump dependencies
• f37e520 feat: update Linux to 6.1.25
• 3920b16 feat: add multi-gen LRU kernel support
• 988f1ec feat: update Linux to 6.1.24
• 5327d12 fix: remove FB_NVIDIA drivers, Linux 6.1.23
• 4eae958 chore: copy over the kernel signing public key
• 174f8fc chore: update Go to 1.20.3
• 41629b0 chore: reorder pkgs for better kernel caching
• b483a6b feat: build 'snp.efi' for iPXE
• fb853ff feat: update containerd to 1.6.20 </p> </details>

Changes from siderolabs/tools

<details><summary>15 commits</summary> <p>

• e0c76c0 chore: bump dependencies
• 7d0cd58 feat: update Go to 1.20.5
• 150efc2 chore: remove non needed tools
• 88ebb40 feat: add swtpm
• 4c5d7fe chore: use same source epoch everywhere
• 2e46e5b feat: add reproducibility pipelines
• c6a41b6 fix: add sd-stub assertion patch
• d2dde48 chore: bump deps
• 8e45ad7 feat: add sbsign
• 271c4a6 feat: add sd-tools
• eedc294 chore: bump deps
• 81b09a5 feat: add libcap and gnuefi
• 47b0fd3 chore: bump go to 1.20.4
• ff4cf2b chore: bump deps
• 1563556 feat: update Go to 1.20.3 </p> </details>

Dependency Changes

• github.com/BurntSushi/toml v1.2.1 -> v1.3.2
• github.com/aws/aws-sdk-go v1.44.232 -> v1.44.287
• github.com/beevik/ntp v0.3.0 -> v1.1.1
• github.com/benbjohnson/clock v1.1.0 -> v1.3.5
• github.com/cenkalti/backoff/v4 v4.2.0 -> v4.2.1
• github.com/containerd/containerd v1.6.19 -> v1.6.21
• github.com/containerd/typeurl/v2 v2.1.1 new
• github.com/containernetworking/plugins v1.2.0 -> v1.3.0
• github.com/cosi-project/runtime v0.3.0 -> v0.3.1-alpha.5
• github.com/docker/distribution v2.8.1 -> v2.8.2
• github.com/docker/docker v23.0.2 -> v24.0.2
• github.com/ecks/uefi caef65d070eb new
• github.com/emicklei/dot v1.4.2 -> v1.5.0
• github.com/hetznercloud/hcloud-go v1.41.0 -> v1.47.0
• github.com/insomniacslk/dhcp 74ae03f2425e -> b20c9ba983df
• github.com/jsimonetti/rtnetlink v1.3.1 -> v1.3.3
• github.com/mattn/go-isatty v0.0.18 -> v0.0.19
• github.com/mdlayher/ethtool ba3b4bc2e02c -> v0.1.0
• github.com/mdlayher/genetlink v1.3.1 -> v1.3.2
• github.com/mdlayher/netlink v1.7.1 -> v1.7.2
• github.com/mdlayher/netx c711c2f8512f -> 7e21880baee8
• github.com/nberlee/go-netstat v0.1.1 -> v0.1.2
• github.com/opencontainers/image-spec v1.1.0-rc2 -> v1.1.0-rc3
• github.com/packethost/packngo v0.29.0 -> v0.30.0
• github.com/prometheus/procfs v0.9.0 -> v0.11.0
• github.com/rivo/tview 281d14d896d7 -> 6cc0565babaf
• github.com/rs/xid v1.4.0 -> v1.5.0
• github.com/scaleway/scaleway-sdk-go v1.0.0-beta.15 -> v1.0.0-beta.17
• github.com/siderolabs/discovery-api v0.1.2 -> v0.1.3
• github.com/siderolabs/discovery-client v0.1.4 -> v0.1.5
• github.com/siderolabs/extras v1.4.0-1-g9b07505 -> v1.5.0-alpha.0-1-ga73d524
• github.com/siderolabs/gen v0.4.3 -> v0.4.5
• github.com/siderolabs/go-blockdevice v0.4.4 -> v0.4.5
• github.com/siderolabs/go-kubernetes v0.2.0 -> v0.2.1
• github.com/siderolabs/go-loadbalancer v0.2.1 -> v0.3.1
• github.com/siderolabs/pkgs v1.4.1-5-ga333a84 -> v1.5.0-alpha.0-28-gedd725a
• github.com/siderolabs/talos/pkg/machinery v1.4.0 -> v1.5.0-alpha.0
• github.com/siderolabs/tools v1.4.0-1-g955aabc -> v1.5.0-alpha.0-14-ge0c76c0
• github.com/spf13/cobra v1.6.1 -> v1.7.0
• github.com/stretchr/testify v1.8.2 -> v1.8.4
• github.com/vmware-tanzu/sonobuoy v0.56.16 -> v0.56.17
• go.etcd.io/etcd/api/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/client/pkg/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/client/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/etcdutl/v3 v3.5.8 -> v3.5.9
• golang.org/x/net v0.8.0 -> v0.11.0
• golang.org/x/sync v0.1.0 -> v0.3.0
• golang.org/x/sys v0.6.0 -> v0.9.0
• golang.org/x/term v0.6.0 -> v0.9.0
• golang.org/x/text v0.10.0 new
• golang.zx2c4.com/wireguard/wgctrl 9c5414ab4bde -> 925a1e7659e6
• google.golang.org/grpc v1.54.0 -> v1.56.1
• k8s.io/api v0.27.1 -> v0.27.3
• k8s.io/apimachinery v0.27.1 -> v0.27.3
• k8s.io/apiserver v0.27.1 -> v0.27.3
• k8s.io/client-go v0.27.1 -> v0.27.3
• k8s.io/component-base v0.27.1 -> v0.27.3
• k8s.io/cri-api v0.27.1 -> v0.27.3
• k8s.io/klog/v2 v2.90.1 -> v2.100.1
• k8s.io/kubectl v0.27.1 -> v0.27.3
• k8s.io/kubelet v0.27.1 -> v0.27.3
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.68 -> v1.2.69

Previous release can be found at v1.4.0

Welcome to the v1.5.0-alpha.0 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Component Updates

• Linux: 6.1.28
• containerd: 1.6.21
• runc: 1.1.7
• etcd: 3.5.9
• Kubernetes: 1.27.2

Talos is built with Go 1.20.4.

Contributors

• Andrey Smirnov
• Noel Georgi
• Utku Ozdemir
• Dmitriy Matrenichev
• Steve Francis
• Budiman Jojo
• Christian Rolland
• Henk Kraal
• Michael A. Davis
• Michael Fornaro
• Nico Berlee
• Niklas Wik
• Ricky Sadowski
• Thomas Perronin

Changes

<details><summary>69 commits</summary> <p>

• 383471c3e feat: update default Kubernetes to v1.27.2
• 8f68d1abe chore: bump deps
• e0c1585d3 feat: create azure community gallery image version on release
• dd8336c9e fix: refresh kubelet self-issued serving certificates
• bb02dd263 chore: drop deprecated stuff for Talos 1.5
• 61cad8673 chore: bump deps
• 01dfd3af7 feat: update etcd to v3.5.9
• aa65fbb8a chore: update KUBECTL_URL to reflect the community bucket
• cc3128d94 chore: bump kernel to 6.1.28
• 97fffaf78 chore: use ctest.UpdateWithConflicts instead of plain UpdateWithConflicts
• 3b36993b9 fix: rlimit nofile test
• 45e6e27af chore: bump runtime
• 4f720d465 fix: revert: set rlimit explicitly in wrapperd
• a2565f674 fix: set rlimit explicitly in wrapperd
• cdfc242b8 chore: re-enable Go buildid
• e67f3f5c5 feat: linux 6.1.27, containerd 1.6.21, go 1.20.4
• 55ae59a0a fix: properly skip/cleanup controlplane configs for workers
• 64eade9bd chore: clean up unused constant
• 62c6e9655 feat: introduce siderolink config resource & reconnect
• 860002c73 fix: don't reload control plane pods on cert SANs changes
• d43c61e80 fix: enforce nolock option for all NFS mounts by default
• 339986db9 fix: inhibit timer to follow kubelet timer
• cbf6dc100 fix: set timeout for unmount calls
• b58f913d5 fix: set the static pod priority as values
• f8a7a5b6b docs: add information about KubeSpan ports and topology
• 2bad74d64 docs: add how to on scaling down
• 7442ff8b0 chore: fix typos inteface -> interface (docs and tests)
• d4e94f7a1 fix: add back required TARGETARCH for installer
• e6fffda01 chore: linux 6.1.26, runc 1.1.7
• 344746ae2 fix: bump max inhibit delay to 20 min
• d9bdea2b5 chore: fork docs and compatibility modules for Talos 1.5
• 3d99610fc docs: document building, verifying image and process caps
• 014008ea2 fix: udevd rules trigger
• 9b36bb613 feat: update Linux to 6.1.25, fix virtio on arm64
• 08ec66c55 feat: clean up (garbage collect) system images which are not referenced
• b097efcde fix: display correct number of machines on dashboard
• cad43f0ad chore: remove k8s master label
• e296a566e fix: support kernel userspace module loading
• 103f0ffdd feat: add startup probes to controller-manager and scheduler
• 5a1ae8aae chore: bump dependences
• ec8c8dbaf chore: fix container image reproducibility
• f661d8487 fix: allow talosctl cp to handle special files in /proc
• 2d824b563 fix: do not show control plane status for workers on dashboard
• e5491ddad docs: update documentation for nocloud
• 7a004a6f7 fix: parse errors correctly
• 374ef5385 test: submit verbose flag to e2e tests
• e1d38b6fe feat: show template URL in dashboard config URL tab
• 45d7f0ce9 docs: fix the latest url
• 96efbf147 docs: activate 1.4.0 docs by default
• 8c1f515b1 feat: update Linux to 6.1.24
• 8689bef5f docs: update documentation for Talos 1.4
• a781dfb8e feat: update Kubernetes to 1.27.1
• a737dd83a chore: typo in compatibility.ParseKubernetesVersion
• f14928b0a fix: fix dashboard crash when a non-existent node is specified
• 3e406d9b0 feat: update etcd to v3.5.8
• bd1cff3e8 chore: remove Go buildid
• e31f7f50b feat: update Kubernetes to 1.27.0
• aa3640d74 docs: update storage.md
• 07bb61e60 chore: module-sig-verify cleanup
• 5e9d836c3 chore: add kernel module signtaure verification
• 3cd1c6bb0 fix: send 'STOP' event on phase end
• 5176d27dc feat: update Kubernetes to 1.27.0-rc.1
• 2c55550a6 fix: quote ISO kernel args for GRUB
• 319d76e38 fix: respect BROWSER=echo in client auth interceptor
• 4e4ace839 chore: update Go to 1.20.3
• 170f73899 fix: correctly parse static pod phase
• c3a595d5b fix: improve action tracking post checks
• eb01edbc8 fix: rework DHCP flow
• e095150a6 test: bump CAPI components versions </p> </details>

Changes from siderolabs/extras

<details><summary>1 commit</summary> <p>

• 36c8ac4 chore: update to Go 1.20.3 </p> </details>

Changes from siderolabs/gen

<details><summary>3 commits</summary> <p>

• f9f5805 chore: bump rekres and add functions from exp
• b968d21 feat: add TryRecv and RecvWithContext functions
• 476dfea feat: add foreach and clear to lazymap </p> </details>

Changes from siderolabs/go-blockdevice

<details><summary>1 commit</summary> <p>

• 076874a chore: resolve blockdevice symlinks </p> </details>

Changes from siderolabs/go-loadbalancer

<details><summary>1 commit</summary> <p>

• f3a0e24 fix: use SO_LINGER option when doing TCP healthchecks </p> </details>

Changes from siderolabs/pkgs

<details><summary>18 commits</summary> <p>

• 702d7a7 chore: bump deps
• 7958db1 chore: copy over sd-boot and sd-stub from tools
• 813b3c3 chore: revert xfsprogs
• 0cc78ab chore: bump kernel to 6.1.28
• 70189e3 chore: bump deps
• c5d3bf1 feat: add sd-stub and sd-boot
• 30a7ac2 feat: update Linux 6.1.27, containerd 1.6.21
• fbc6ee5 chore: bump deps
• 82b9489 chore: bump dependencies
• f37e520 feat: update Linux to 6.1.25
• 3920b16 feat: add multi-gen LRU kernel support
• 988f1ec feat: update Linux to 6.1.24
• 5327d12 fix: remove FB_NVIDIA drivers, Linux 6.1.23
• 4eae958 chore: copy over the kernel signing public key
• 174f8fc chore: update Go to 1.20.3
• 41629b0 chore: reorder pkgs for better kernel caching
• b483a6b feat: build 'snp.efi' for iPXE
• fb853ff feat: update containerd to 1.6.20 </p> </details>

Changes from siderolabs/tools

<details><summary>8 commits</summary> <p>

• d2dde48 chore: bump deps
• 8e45ad7 feat: add sbsign
• 271c4a6 feat: add sd-tools
• eedc294 chore: bump deps
• 81b09a5 feat: add libcap and gnuefi
• 47b0fd3 chore: bump go to 1.20.4
• ff4cf2b chore: bump deps
• 1563556 feat: update Go to 1.20.3 </p> </details>

Dependency Changes

• github.com/aws/aws-sdk-go v1.44.232 -> v1.44.264
• github.com/beevik/ntp v0.3.0 -> v1.0.0
• github.com/benbjohnson/clock v1.1.0 -> v1.3.5
• github.com/cenkalti/backoff/v4 v4.2.0 -> v4.2.1
• github.com/containerd/containerd v1.6.19 -> v1.6.20
• github.com/containerd/typeurl/v2 v2.1.1 new
• github.com/containernetworking/plugins v1.2.0 -> v1.3.0
• github.com/cosi-project/runtime v0.3.0 -> 82b69d862a7a
• github.com/docker/docker v23.0.2 -> v23.0.6
• github.com/hetznercloud/hcloud-go v1.41.0 -> v1.45.1
• github.com/insomniacslk/dhcp 74ae03f2425e -> 49801966e6cb
• github.com/jsimonetti/rtnetlink v1.3.1 -> v1.3.3
• github.com/mdlayher/genetlink v1.3.1 -> v1.3.2
• github.com/mdlayher/netlink v1.7.1 -> v1.7.2
• github.com/mdlayher/netx c711c2f8512f -> 7e21880baee8
• github.com/nberlee/go-netstat v0.1.1 -> v0.1.2
• github.com/opencontainers/image-spec v1.1.0-rc2 -> v1.1.0-rc3
• github.com/rivo/tview 281d14d896d7 -> 822bd067b165
• github.com/rs/xid v1.4.0 -> v1.5.0
• github.com/scaleway/scaleway-sdk-go v1.0.0-beta.15 -> v1.0.0-beta.16
• github.com/siderolabs/extras v1.4.0-1-g9b07505 -> v1.5.0-alpha.0
• github.com/siderolabs/gen v0.4.3 -> v0.4.5
• github.com/siderolabs/go-blockdevice v0.4.4 -> v0.4.5
• github.com/siderolabs/go-loadbalancer v0.2.1 -> v0.2.2
• github.com/siderolabs/pkgs v1.4.1-5-ga333a84 -> v1.5.0-alpha.0-17-g702d7a7
• github.com/siderolabs/talos/pkg/machinery v1.4.0 -> v1.4.4
• github.com/siderolabs/tools v1.4.0-1-g955aabc -> v1.5.0-alpha.0-7-gd2dde48
• github.com/spf13/cobra v1.6.1 -> v1.7.0
• go.etcd.io/etcd/api/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/client/pkg/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/client/v3 v3.5.8 -> v3.5.9
• go.etcd.io/etcd/etcdutl/v3 v3.5.8 -> v3.5.9
• golang.org/x/net v0.8.0 -> v0.10.0
• golang.org/x/sync v0.1.0 -> v0.2.0
• golang.org/x/sys v0.6.0 -> v0.8.0
• golang.org/x/term v0.6.0 -> v0.8.0
• golang.zx2c4.com/wireguard/wgctrl 9c5414ab4bde -> 925a1e7659e6
• google.golang.org/grpc v1.54.0 -> v1.55.0
• k8s.io/api v0.27.1 -> v0.27.2
• k8s.io/apimachinery v0.27.1 -> v0.27.2
• k8s.io/apiserver v0.27.1 -> v0.27.2
• k8s.io/client-go v0.27.1 -> v0.27.2
• k8s.io/component-base v0.27.1 -> v0.27.2
• k8s.io/klog/v2 v2.90.1 -> v2.100.1
• k8s.io/kubectl v0.27.1 -> v0.27.2
• k8s.io/kubelet v0.27.1 -> v0.27.2
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.68 -> v1.2.69

Previous release can be found at v1.4.0