v1.2.0-beta.1

[smira]

Talos 1.2.0-beta.1 (2022-08-23)

Welcome to the v1.2.0-beta.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Talos API access from Kubernetes

Talos now supports access to its API from within Kubernetes. It can be configured in the machine config as below:

machine:
  features:
    kubernetesTalosAPIAccess:
      enabled: true
      allowedRoles:
        - os:reader
      allowedKubernetesNamespaces:
        - kube-system

This feature introduces a new custom resource definition, serviceaccounts.talos.dev.
Creating custom resources of this type will provide credentials to access Talos API from within Kubernetes.

The new CLI subcommand talosctl inject serviceaccount can be used to configure Kubernetes manifests with Talos service accounts as below:

talosctl inject serviceaccount -f manifests.yaml > manifests-injected.yaml
kubectl apply -f manifests-injected.yaml

See documentation for more details.

Apply Config Patches

talosctl apply-config now supports patching the machine config file in memory before submitting it to the node.

Etcd Configuration

Configuration setting cluster.etcd.subnet is deprecated, but still supported.

Two new configuration settings are introduce to control precisely which subnet is used for etcd peer communication:

cluster:
  etcd:
    advertisedSubnets:
       - 10.0.0.0/24
    listenSubnets:
       - 10.0.0.0/24
       - 192.168.0.0/24

The advertisedSubnets setting is used to control which subnet is used for etcd peer communication, it will be advertised
by each peer for other peers to connect to. If advertiseSubnets is set, listenSubnets defaults to the same value, so that
etcd only listens on the same subnet as it advertises. Additional subnets can be configured in listenSubnets if needed.

Default behavior hasn't changed - if the advertisedSubnets is not set, Talos picks up the first available network address as
advertised address and etcd is configured to listen on all interfaces.

Note: most of the etcd configuration changes are accepted on the fly, but they are fully applied only after reboot.

Generating Talos secrets from PKI directory

It is now possible to generate a secrets bundle from a Kubernetes PKI directory (e.g. /etc/kubernetes/pki).

You can also specify a bootstrap token to be used in the secrets bundle.

This secrets bundle can then be used to generate a machine config.

This facilitates migrating clusters (e.g. created using kubeadm) to Talos.

talosctl gen secrets --kubernetes-bootstrap-token znzio1.1ifu15frz7jd59pv --from-kubernetes-pki /etc/kubernetes/pki
talosctl gen config --with-secrets secrets.yaml my-cluster https://172.20.0.1:6443

Kubernetes ControlPlane Components

Talos now run all Kubernetes Control Plane Components with the CRI default Seccomp Profile and other recommendations as described in
KEP-2568.

Kubelet Default Runtime Seccomp Profile

Talos now runs Kubelet with the CRI default Seccomp Profile enabled.
This can be disabled by setting .machine.kubelet.defaultRuntimeSeccompProfileEnabled to false.

This is not enabled automatically on upgrades, so upgrading to Talos v1.2 needs this to be explicitly enabled.

Kubernetes Control Plane labels and taints

Talos now defaults to node-role.kubernetes.io/control-plane label/taint.
On upgrades Talos now removes the node-role.kubernetes.io/master label/taint on control-plane nodes and replaces it with the node-role.kubernetes.io/control-plane label/taint.
Workloads that tolerate the old taints or having node selectors with the old labels will need to be updated.

Kubernetes Discovery Backend

Kubernetes cluster discovery backend is now disabled by default for new clusters.
This backend doesn't provide any benefits over the Discovery Service based backend, while it
causes issues for KubeSpan enabled clusters when control plane endpoint is KubeSpan-routed.

For air-gapped installations when the Discovery Service is not enabled, Kubernetes Discovery Backend can be enabled by applying
the following machine configuration patch:

cluster:
  discovery:
    registries:
      kubernetes:
        disabled: false

KubeSpan Kubernetes Network Advertisement

KubeSpan no longer by default advertises Kubernetes pod networks of the node over KubeSpan.
This means that CNI should handle encapsulation of pod-to-pod traffic into the node-to-node tunnel,
and node-to-node traffic will be handled by KubeSpan.
This provides better compatibility with popular CNIs like Calico and Cilium.

Old behavior can be restored by setting .machine.kubespan.advertiseKubernetesNetworks = true in the machine config.

MachineConfig .cluster.allowSchedulingOnMasters deprecated

The .cluster.allowSchedulingOnMasters is deprecated and replaced by .cluster.allowSchedulingOnControlPlanes.
The .cluster.allowSchedulingOnMasters will be removed in a future release of Talos.
If both .cluster.allowSchedulingOnMasters and .cluster.allowSchedulingOnControlPlanes are set to true, the .cluster.allowSchedulingOnControlPlanes will be used.

k8s.gcr.io mirror configuration

Talos now defaults to adding a registry mirror configuration in the machineconfig for k8s.gcr.io pointing to both registry.k8s.io and k8s.gcr.io unless overridden.
This is in line with the Kubernetes 1.25 release having the new registry.k8s.io registry endpoint.

This is only enabled by default on newly generated configurations and not on upgrades.
This can be enabled with a machine configuration as follows:

machine:
  registries:
    mirrors:
      k8s.gcr.io:
        endpoints:
          - https://registry.k8s.io
          - https://k8s.gcr.io

Network bridge support

Talos now supports configuring Linux bridges. It can be configured in the machine config like the following:

machine:
  network:
    interfaces:
      - interface: br0
        bridge:
          stp:
            enabled: true
          interfaces:
            - eth0
            - eth1

See documentation for more details.

VLAN support in cmdline arguments

Talos now supports dracut-style vlan kernel argument to allow
installing Talos Linux in networks where ports are not tagged
with a default VLAN:

vlan=eth1.5:eth1 ip=172.20.0.2::172.20.0.1:255.255.255.0::eth1.5:::::

NVIDIA GPU support promoted to beta

NVIDIA GPU support on Talos has been promoted to beta and SideroLabs now publishes the NVIDIA Open GPU Kernel Modules as a system extension making it easier to run GPU workloads on Talos. Refer to enabling NVIDIA GPU support docs here:

• https://www.talos.dev/v1.2/talos-guides/configuration/nvidia-gpu/
• https://www.talos.dev/v1.2/talos-guides/configuration/nvidia-gpu-proprietary/
• https://www.talos.dev/v1.2/talos-guides/configuration/nvidia-fabricmanager/

Packet Capture

Talos now supports capturing packets on a network interface with talosctl pcap command:

talosctl pcap --interface eth0

Seccomp Profiles

Talos now supports creating custom seccomp profiles on the host machine which in turn can be used by Kubernetes workloads.
It can be configured in the machine config as below:

machine:
  seccompProfiles:
    - name: audit.json
      value:
        defaultAction: SCMP_ACT_LOG
    - name: deny.json
      value: {"defaultAction":"SCMP_ACT_LOG"}

This profile data can be either configured as a YAML definition or as a JSON string.

The profiles are created on the host under /var/lib/kubelet/seccomp/profiles.

See documentation for more details.

Stable Default Hostname

Talos now generates the default hostname (when there is no explicitly specified hostname) for the nodes based on the
node id (e.g. talos-2gd-76y) instead of using the DHCP assigned IP address (e.g. talos-172-20-0-2).

This ensures that the node hostname is not changed when DHCP assigns a new IP to a node.

Please note: the stable hostname generation algorithm changed between v1.2.0-beta.0 and v1.2.0-beta.1, please take care when upgrading
from versions >= 1.2.0-alpha.1 to versions >= 1.2.0-beta.1 when using stable default hostname feature.

Strategic merge machine configuration patching

In addition to JSON (RFC6902) patches Talos now supports strategic merge patching.

For example, machine hostname can be set with the following patch:

machine:
  network:
    hostname: worker1

Patch format is detected automatically.

Variable substitution for URL query parameter in the talos.config kernel parameter

The kernel parameter talos.config can now substitute system information into placeholders inside its URL query values. This example shows all supported variables:

http://example.com/metadata?h=${hostname}&m=${mac}&s=${serial}&u=${uuid}

talosctl

--masters flag on talosctl cluster create is deprecated. Use --controlplanes instead.

Component Updates

• Linux: 5.15.62
• Flannel 0.19.1
• containerd 1.6.8
• Kubernetes: v1.25.0-rc.1

Talos is built with Go 1.19.

Contributors

• Andrey Smirnov
• Noel Georgi
• Utku Ozdemir
• Dmitriy Matrenichev
• Artem Chernyshev
• Philipp Sauter
• Tim Jones
• Spencer Smith
• Davincible
• Eirik Askheim
• Steve Francis
• AMet
• Alex Wied
• Bermi Ferrer
• Branden Cash
• Charlie Haley
• Christoph Schmatzler
• Dennis Marttinen
• Eng Zer Jun
• Flightkick
• Florian Klink
• Gwyn
• Han Cen
• Larry Rosenman
• Markus Reiter
• Matthew Richardson
• Nico Berlee
• Rio Kierkels
• Robert Wunderer
• RyanSquared
• Serge Logvinov
• Seán C McCord
• Tommy Botten Jensen
• Trevor Sullivan
• hobyte
• nett_hier
• zebernst

Changes

205 commits

• 4f54e9b46 release(v1.2.0-beta.1): prepare release
• cb492c163 fix: don't wait for the hostname in maintenance mode
• f8a5a1a56 fix: stable default hostname bias
• 465f60c6c feat: update etcd advertised peer addresses on the fly
• 30707d064 chore: bump kubernetes to v1.25.0-rc.1
• 518da6c72 fix: make 'ca', 'crt' and 'key' flags optional for 'talosctl config add'
• 28ffff59a fix: handle grub config being empty in the Revert function
• 6f89c8f7b fix: clean up cancelCtxMu leftovers in PriorityLock
• 9bbb6a943 fix: surround cancelCtx with the mutex
• f04b9f88c fix: talosctl edit mc loop
• 5b4261499 docs: nvidia gpu beta support
• 653acb8df chore: bump kernel to 5.15.62
• 3bbcc116e chore: bump containerd to v1.6.8
• d6dbac444 docs: correct link to api access from k8s
• 20d0b56a4 release(v1.2.0-beta.0): prepare release
• f37da96ef feat: enable talos client to connect to Talos through an auth proxy
• 123d32174 chore: validate that etcd ca is not empty
• 0fe4492e7 chore: bump golangci-lint from 1.47.2 to 1.48.0
• 7e527777e chore: update API descriptors
• 65098c14e chore: bump to the final released versions
• 9512e8f30 feat: allow modules to be loaded via extension
• 2c482936b chore: bump dependencies
• 586e29dfc feat: add event actor id to client api and events cmd
• 9baca4966 refactor: implement COSI resource API for Talos
• d04211f85 feat: add new event watch fn and return action responses on API
• f88d08e21 docs: clarification of AWS set up process
• b48adb8ec chore: revert kernel with BTF support
• e422ea63d chore: add proto definitions for common types
• 5c6648e3d fix: make talosctl command return nonzero error codes if it had errors
• dce923f74 feat: allow configuring etcd listen addresses
• 4c3485ae3 feat: update Kubernetes to 1.25.0-rc.0
• ea6ceab24 chore: bump kernel to 5.15.60
• 20a564085 fix: introduce 'routed' NodeAddresses and use them in kubelet
• f1de47894 docs: verbiage in Digital Ocean tutorial
• 6b23deddc feat: support custom ports for connecting to apid from talosctl
• 07cd0924e fix: recursive seccomp mounts
• 696f2b735 chore: update kernel to the version with BTF support
• b5da686a7 feat: add actor ID to events & emit an initial empty event
• fec0ed29d fix: add missing LinkStatusType registration
• 13499fc30 feat: support patching the machine config in the apply-config cmd
• be351dcb9 release(v1.2.0-alpha.2): prepare release
• 5dd1b4002 feat: disable Kubernetes discovery backend by default
• b62b18a97 feat: bump k8s to v1.25.0-beta.0
• 7b80a747b feat: add protobuf encoding/decoding for Go structs
• 00c3ee3ac docs: remove obsolete references to init nodes
• 6eefa9d9c fix: properly filter resources in maintenance server
• fa5aad01a docs: fix issues in GCP docs
• 98f056603 chore: bump dependencies
• 84e712a9f feat: introduce Talos API access from Kubernetes
• d7be30892 chore: bump kernel to 5.15.59
• c2c2d65bc refactor: use COSI access filter for resource access
• 1dee0579e feat: add support for proxying one-to-one to apid
• 86eb01cd6 docs: add missing dev tools
• 4fd676c04 docs: fix typo in theila name
• 856beb21c feat: containerd 1.6.7, Flannel 1.19.1
• e97b9f6d3 feat: support dhcp options for vlan
• 92314e47b refactor: use controllers/resources to feed trustd with data
• 80d298abf feat: support skipping node registration
• 7795de313 fix: use controllers/resources for etcd configuration
• f9b664c94 fix: reload trusted CA list when client is recreated
• 8847ccd03 fix: shutdown some streaming API calls when machined API is shuting down
• f95b53726 fix: allow files in extension spec
• 1a8f6ec8e fix: don't advertise Kubernetes pod networks over KubeSpan by default
• e3d4a0e4d fix: make reset work even if the node is not bootstrapped/not joined
• a6b010a8b chore: update Go to 1.19, Linux to 5.15.58
• fb058a7c9 test: use T.TempDir to create temporary test directory
• 6fc38bae6 fix: iterate over etcd members endpoints for member promotion
• c70b692fb fix: update default address if removed from the host
• cf620d473 feat: read talosconfig from secrets directory
• 1ad8e6122 fix: keep entire vlan id when parsing cmdline
• fe2ee3b10 feat: implement MachineStatus resource
• 670d274c4 chore: bump dependencies
• 08d2612e0 docs: bond devices are comma separated
• c3c3e14db chore: add gotagsrewrite tool and use it to add tags to resources
• 2e790526f refactor: make apid stop gracefully and be stopped late
• 0cdf22243 fix: retry Conflict errors when upgrading k8s manifests
• 1db097f50 release(v1.2.0-alpha.1): prepare release
• 5ac4947b6 feat: enable default seccomp profile for kubelet
• e5994ff7a fix: skip ResetDuringBoot test if the Cluster config is unknown
• 8028e1074 fix: wait for boot done when rebooting a node in the integration tests
• ae1bec59e feat: allow running only one sequence at a time
• ec05aee04 fix: correctly unwrap errors when streaming
• 7c7f2d8c3 feat: refactor disk size matcher to be compatible with DeepEqual
• 3addea83b feat: introduce support for Talos API access from Kubernetes
• 34d3a4164 docs: add missing <> to relref
• c4d2d20c4 fix: enable stable hostnames for worker configs as well
• 0326bac1f chore: bump kernel to 5.15.57
• 86820c33f chore: bump dependencies
• 6e7dfeeb3 fix: data race in packet capture (part 2)
• c11e1dae7 docs: fix spelling and grammar errors
• 30f7851d2 chore: bump golangci-lint from 1.45.2 to 1.47.2
• 2cce9112d chore: bump goimports from 0.1.10 to 0.1.11
• 18756c7ff fix: folder permissions of overlay mounted folders
• 47c35dc47 feat: set stable default hostname based on machine-id
• 1ed3df295 chore: support glibc apps extension spec
• a2aea9726 fix: write etcd PKI files in a controller
• bb4abc096 fix: regenerate kubelet certs when hostname changes
• d650afb6c chore: fix typo in powercycle
• 644e803ad fix: use masks and different firewall mark for KubeSpan
• 80444a43d fix: remove data race in pcap capture
• 04a45dff2 docs: remove katacoda links
• 065b59276 feat: implement packet capture API
• 7c006cabc feat: update Kubernetes to 1.24.3
• 551290195 chore: bump dependencies
• 1677bcc4b fix: skip bond itself when matching interface (Equinix Metal)
• f1c2b5c55 feat: implement strategic merge patching for API server admission config
• be98cb82b feat: follow KEP-2568 non-root enhancements
• 87ea1d961 fix: update kubelet kubeconfig when cluster control plane endpoint changes
• a75fe7600 feat: gen secrets from kubernetes pki dir
• a1d7b535a docs: add kubeadm migration guide
• 9e0c56581 docs: guide for setting up synology-csi driver
• f0b8eea5e refactor: remove bootstrap sequence
• 89c7da899 docs: add documentation for vagrant & libvirt
• 014b85fdc docs: improve talos kubernetes upgrade note
• 88bb017ed docs: remove old docs from site
• c92c90655 feat: build talosctl for FreeBSD
• 616da3069 docs: update last release for 1.1
• 091e6ef0e feat: resubstitute talos.config url variables on retry
• ec74ab38a feat: update Go to 1.18.4, Linux to 5.15.54
• 641f6a1e4 feat: expose strategic merge config patches
• 6e3d2d647 docs: fix disk encryption params
• c43d6a31d docs: fix typos
• 551887528 chore: bump dependencies
• 626ef05e6 fix: correct SANs for etcd certs
• 83ce92c5f docs: fix theila docs
• 8a038d40e fix: stabilize etcd join and promote sequences
• 136122556 fix: use correct etcd cert path
• c170ec0b0 chore: bump kernel to 5.15.53
• d924901b7 feat: add cli subcommand to generate secrets
• 34aabedd8 feat: more circular pkg from internal to pkg
• 4f044e466 feat: implement strategic merge machine config patching
• c2a512608 fix: avoid double append of talos.platform kernel argument
• 27dfe7c03 fix: perform accurate conflict resolution on overal (kubespan)
• e437445b4 chore: bump kernel to 5.15.52
• d27a6a4ac feat: add vlan support to cmdline
• fdca5d8a9 chore: bump dependencies
• ae3840dbc refactor: move kubeconfig package under public api
• 184e113f3 chore: disable systeminfo controller in container
• 86a0a7bdf refactor: use pointer types more in machine config structs
• 3a1eb10e6 docs: update the Proxmox kvm64 note
• 30e220fcd docs: kernel cmdline params updated on upgrades
• 915de9cf9 docs: fix bridge documentation
• 52cd12951 test: bump Talos versions in upgrade tests
• 022581d80 release(v1.2.0-alpha.0): prepare release
• 643e81cfe feat: add SenseLabs to ADOPTERS.md
• bdfee2b3b chore: bump kernel to 5.15.51
• 36c44a651 fix: provide CA certificates in /etc/ssl/certs/ca-certificates.crt
• 7ebd9bcce docs: fix pod security talos resource name
• 57b625e0a refactor: avoid recreating grpc clients in service health checks
• a68a00f1b docs: recommend setting "host" Processor Type on proxmox
• 923600a73 chore: bump kernel to 5.15.50
• 758a9bf59 docs: add theila ui
• b81016e62 chore: update blockdevice library to v0.3.3
• 284a2f959 fix: filter static pods correctly and optimize fetching
• 61abf3111 docs: change command for cluster create to keep $HOME with sudo
• 6ae1e9bf2 chore: bump dependencies
• 2deff6b6e feat: add support for variable substitution in talos.config kernel parameter
• 103c94225 fix: update crypto library with support for RSA-SHA*
• 448de7194 docs: add UpCloud installation guide
• 07014e0a8 fix: generate correct bootstrap manifests when only IPv6 CIDR is used
• 465edbb47 fix: look for qemu-kvm binary
• 63caa281a fix: create native image format for DigitalOcean
• f15ce549e fix: siderlink api assume port 443 with https schema
• 797596229 feat: add support for configuring network bridges
• 2b23fabcc docs: use SVG image for K8s conformance
• d4606c33e chore: bump kernel to 5.15.49
• cfb640222 docs: update docs for release 1.1
• b816d0b60 docs: fix the vendor information for Kubernetes conformance tests
• a167a5402 test: fix CLI nodes discovery without provisioner data
• 916a30682 docs: add twitter meta info
• 80090a3ed test: fix health endpoint cli test when discovery is disabled
• 3c263bb44 chore: bump dependencies
• e8113527f chore: bump kubernetes to v1.24.2
• 068f1b6d0 feat: add ctest package and base for test suite
• 2aad3a1e4 chore: bump kernel to 5.15.48
• a31a858e0 docs: snippets for logging api server audit logs
• 89aaaef9f chore: bump kernel to 5.15.47
• 6759fcd4a feat: use discovery service on cluster health checks
• f54d90787 fix: enable orderly poweroff in hyper-v on Azure
• 35475ce45 docs: openebs jiva example with iscsi-tools extension
• 8d2be5e31 feat: extend node definition used in health checks
• 7a11b4def fix: make talosctl bootstrap accept only single node
• 217fba288 test: fix csi tests
• 90bf34fed docs: fork docs for Talos 1.2
• a0dd010a8 docs: add link to discovery service in kubespan
• c0371410e fix: support SideroLink "secure" gRPC connection
• b03709620 feat: build Talos images with system extensions included
• 43def7490 chore: bump kernel and runc
• 4dbbf4ac5 chore: add generic methods and use them part feat(*): initial implementation #2
• 7114292b6 docs: fix latest release version in docs
• da2985fe1 fix: respect local API server port
• e03266667 fix: correctly validate reboot mode in CLI
• 70fc42409 chore: add generic methods and use them
• 3ae8bdd92 chore: run xfs_repair on xfs filesystem returing EUCLEAN
• 0c91c89f4 chore: revert day-two tests for csi tests
• f71b58312 feat: disallow anonymous requests by default (kube-apiserver)
• c19dd1b89 feat: add 'etcd members should be control plane nodes' health check
• f2997c0f2 chore: bump dependencies
• f3efec4b5 feat: update containerd 1.6.6, Linux 5.15.45, Flannel 0.18.1
• 27f8e50ce fix: add ovmf image path for rhel
• 87e7de30c docs: fix required ports
• c126f2ee8 chore: bump golang to 1.18.3
• c1aed6240 fix: wait for /var to be mounted in kubelet service controller
• d7a64f5d2 fix: improve vip operator shutdown sequence
• 7b9dfcb85 chore: add 'make go-mod-outdated'

Changes since v1.2.0-beta.0

14 commits

• 4f54e9b46 release(v1.2.0-beta.1): prepare release
• cb492c163 fix: don't wait for the hostname in maintenance mode
• f8a5a1a56 fix: stable default hostname bias
• 465f60c6c feat: update etcd advertised peer addresses on the fly
• 30707d064 chore: bump kubernetes to v1.25.0-rc.1
• 518da6c72 fix: make 'ca', 'crt' and 'key' flags optional for 'talosctl config add'
• 28ffff59a fix: handle grub config being empty in the Revert function
• 6f89c8f7b fix: clean up cancelCtxMu leftovers in PriorityLock
• 9bbb6a943 fix: surround cancelCtx with the mutex
• f04b9f88c fix: talosctl edit mc loop
• 5b4261499 docs: nvidia gpu beta support
• 653acb8df chore: bump kernel to 5.15.62
• 3bbcc116e chore: bump containerd to v1.6.8
• d6dbac444 docs: correct link to api access from k8s

Changes from siderolabs/extras

4 commits

• siderolabs/extras@d5b9cf7 chore: update to the final tagged pkgs
• siderolabs/extras@da35a63 feat: update Go to 1.19
• siderolabs/extras@17a319f chore: update Go to 1.18.4
• siderolabs/extras@892407f chore: bump golang to 1.18.3

Changes from siderolabs/pkgs

38 commits

• siderolabs/pkgs@a7609bb fix: nvidia oss pkg name
• siderolabs/pkgs@774e062 chore: bump kernel to 5.15.62
• siderolabs/pkgs@8a338a3 fix: containerd version
• siderolabs/pkgs@03efe67 chore: bump containerd to v1.6.8
• siderolabs/pkgs@a2c572d chore: use final tagged tools image
• siderolabs/pkgs@8cb7fff feat: add nvidia open gpu kernel modules
• siderolabs/pkgs@165c278 feat: revert build kernel with BTF enabled
• siderolabs/pkgs@b8062ef chore: bump nvidia drivers to 515.65.01
• siderolabs/pkgs@737b510 chore: bump kernel to 5.15.60
• siderolabs/pkgs@1ee594a feat(kernel): build kernel with BTF enabled
• siderolabs/pkgs@7783ee3 chore: bump kernel to 5.15.59
• siderolabs/pkgs@360d596 feat: update containerd to 1.6.7
• siderolabs/pkgs@6feece4 feat: update Go to 1.19
• siderolabs/pkgs@9ad3aeb chore: bump kernel to 5.15.58
• siderolabs/pkgs@dcc0311 chore: bump kernel to 5.15.57
• siderolabs/pkgs@b943a9d chore: update Go to 1.18.4
• siderolabs/pkgs@a44e324 chore: bump kernel to 5.15.54
• siderolabs/pkgs@247f567 chore: bump kernel to 5.15.53
• siderolabs/pkgs@4fe9867 chore: bump openssl to 1.1.1q
• siderolabs/pkgs@9ee662c chore: bump kernel to 5.15.52
• siderolabs/pkgs@4412db8 chore: bump kernel to 5.15.51
• siderolabs/pkgs@6fedbdc chore: bump tools
• siderolabs/pkgs@f1f44e6 chore: bump kernel to 5.15.50
• siderolabs/pkgs@388af5e chore: bump openssl to 1.1.1p
• siderolabs/pkgs@ed75c50 chore: enable RANDOM_TRUST_BOOTLOADER by default
• siderolabs/pkgs@7c243f6 chore: bump kernel to 5.15.49
• siderolabs/pkgs@6e1269e chore: bump kernel to 5.15.48
• siderolabs/pkgs@5d671a3 chore: bump nvidia drivers to 515.48.07
• siderolabs/pkgs@b35d835 chore: bump kernel to 5.15.47
• siderolabs/pkgs@6604d6b feat: hyperv arm64
• siderolabs/pkgs@c474058 chore: bump nvidia driver to 515.43.04
• siderolabs/pkgs@5bc7e34 feat: update runc to 1.1.3, libseccomp to 2.5.4
• siderolabs/pkgs@c02cd7a chore: bump kernel to 5.15.46
• siderolabs/pkgs@b9c72a5 feat: update containerd to 1.6.6
• siderolabs/pkgs@f7786a3 chore: bump kernel to 5.15.45
• siderolabs/pkgs@b1c207d feat: update containerd to 1.6.5
• siderolabs/pkgs@4d47830 chore: bump golang to 1.18.3
• siderolabs/pkgs@dc21e30 chore: bump kernel to 5.15.44

Changes from siderolabs/tools

8 commits

• siderolabs/tools@ac357ec feat: add pahole so kernel can be built with BTF support
• siderolabs/tools@cd35510 feat: update Go to 1.19
• siderolabs/tools@e83198d chore: bump git to v2.37.1
• siderolabs/tools@0d669dd feat: update Go 1.18.4
• siderolabs/tools@26b32d5 chore: bump openssl to 1.1.1q
• siderolabs/tools@d8015e7 chore: bump curl to 7.84.0
• siderolabs/tools@3ec03ed chore: bump openssl to 1.1.1p
• siderolabs/tools@3df9e13 chore: bump golang to 1.18.3

Changes from talos-systems/crypto

1 commit

• siderolabs/crypto@e9df1b8 feat: add support for generating keys from RSA-SHA256 CAs

Changes from talos-systems/go-blockdevice

2 commits

• siderolabs/go-blockdevice@74ea471 feat: add freebsd stubs
• siderolabs/go-blockdevice@9fa801c feat: add ReadOnly attribute to Disk

Changes from talos-systems/go-loadbalancer

1 commit

• siderolabs/go-loadbalancer@b578d47 feat: add a way to configure loadbalancer options

Changes from talos-systems/grpc-proxy

1 commit

• siderolabs/grpc-proxy@6dfa2cc fix: ignore errors on duplicate SetHeader calls

Dependency Changes

• cloud.google.com/go/compute v1.6.1 -> v1.8.0
• github.com/BurntSushi/toml v1.1.0 -> v1.2.0
• github.com/aws/aws-sdk-go v1.44.24 -> v1.44.76
• github.com/containerd/containerd v1.6.4 -> v1.6.8
• github.com/containernetworking/cni v1.1.0 -> v1.1.2
• github.com/cosi-project/runtime 95d06feaf8b5 -> v0.1.0
• github.com/docker/docker v20.10.16 -> v20.10.17
• github.com/emicklei/dot v0.16.0 -> v1.0.0
• github.com/gertd/go-pluralize v0.2.1 new
• github.com/google/gopacket v1.1.19 new
• github.com/google/nftables a9775fb167d2 -> 2eca00135732
• github.com/hashicorp/go-getter v1.6.1 -> v1.6.2
• github.com/hashicorp/go-version v1.5.0 -> v1.6.0
• github.com/hetznercloud/hcloud-go v1.33.2 -> v1.35.2
• github.com/insomniacslk/dhcp 1ca156eafb9f -> 509691fd59ec
• github.com/jsimonetti/rtnetlink v1.2.0 -> v1.2.1
• github.com/martinlindhe/base36 v1.1.1 new
• github.com/mattn/go-isatty v0.0.14 -> v0.0.16
• github.com/packethost/packngo v0.24.0 -> v0.25.0
• github.com/prometheus/procfs v0.7.3 -> v0.8.0
• github.com/rivo/tview 9994674d60a8 -> 0e6b21a48e96
• github.com/siderolabs/extras v1.1.0-1-g5800284 -> v1.2.0
• github.com/siderolabs/pkgs v1.1.0-8-gfa9a488 -> v1.2.0-4-ga7609bb
• github.com/siderolabs/tools v1.1.0-1-g134974c -> v1.2.0
• github.com/spf13/cobra v1.4.0 -> v1.5.0
• github.com/stretchr/testify v1.7.1 -> v1.8.0
• github.com/talos-systems/crypto v0.3.5 -> v0.3.6
• github.com/talos-systems/go-blockdevice v0.3.2 -> v0.3.4
• github.com/talos-systems/go-loadbalancer v0.1.2 -> v0.1.3
• github.com/talos-systems/grpc-proxy v0.3.0 -> v0.3.1
• github.com/u-root/u-root v0.8.0 -> v0.9.0
• github.com/vishvananda/netlink v1.2.0-beta -> v1.2.1-beta.2
• github.com/vmware-tanzu/sonobuoy v0.56.6 -> v0.56.9
• github.com/vmware/govmomi v0.28.0 -> v0.29.0
• go.uber.org/zap v1.21.0 -> v1.22.0
• golang.org/x/net 5463443f8c37 -> 3211cb980234
• golang.org/x/sync 0976fa681c29 -> 886fb9371eb4
• golang.org/x/sys bc2c85ada10a -> fbc7d0a398ab
• golang.org/x/term 065cf7ba2467 -> a9ba230a4035
• golang.org/x/time 583f2d630306 -> e5dcc9cfc0b9
• google.golang.org/grpc v1.46.2 -> v1.48.0
• google.golang.org/protobuf v1.28.0 -> v1.28.1
• gopkg.in/yaml.v3 496545a6307b -> v3.0.1
• inet.af/netaddr c74959edd3b6 -> 502d2d690317
• k8s.io/api v0.24.2 -> v0.25.0-rc.1
• k8s.io/apimachinery v0.24.2 -> v0.25.0-rc.1
• k8s.io/apiserver v0.24.2 -> v0.25.0-rc.1
• k8s.io/client-go v0.24.2 -> v0.25.0-rc.1
• k8s.io/component-base v0.24.2 -> v0.25.0-rc.1
• k8s.io/cri-api v0.24.2 -> v0.25.0-rc.1
• k8s.io/kubectl v0.24.2 -> v0.25.0-rc.1
• k8s.io/kubelet v0.24.2 -> v0.25.0-rc.1
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.64 -> v1.2.65

Previous release can be found at v1.1.0

Images

ghcr.io/siderolabs/flannel:v0.19.1
ghcr.io/siderolabs/install-cni:v1.2.0
docker.io/coredns/coredns:1.9.3
gcr.io/etcd-development/etcd:v3.5.4
k8s.gcr.io/kube-apiserver:v1.25.0-rc.1
k8s.gcr.io/kube-controller-manager:v1.25.0-rc.1
k8s.gcr.io/kube-scheduler:v1.25.0-rc.1
k8s.gcr.io/kube-proxy:v1.25.0-rc.1
ghcr.io/siderolabs/kubelet:v1.25.0-rc.1
ghcr.io/siderolabs/installer:v1.2.0-beta.1
k8s.gcr.io/pause:3.6

---

This discussion was created from the release v1.2.0-beta.1.