Skip to content

v1.7.1
Compare
Choose a tag to compare
@github-actions github-actions released this 05 May 14:40
· 9 commits to release-1.7-turingrk1 since this release
v1.7.1
This tag was signed with the committer’s verified signature.
nberlee Nico Berlee
GPG key ID: 539FFB087CD57940
Learn about vigilant mode.
621e995
This commit was signed with the committer’s verified signature.
nberlee Nico Berlee
GPG key ID: 539FFB087CD57940
Learn about vigilant mode.

Talos 1.7.1 (2024-05-05)

Welcome to the v1.7.1 release of Talos for the Turing RK1!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

[Documentation on What's New in Talos 1.7.0

CA Rotation

Talos Linux now supports rotating the root CA certificate and key for Talos API and Kubernetes API.

Device Selectors

Talos Linux now supports physical: true qualifier for device selectors, it selects non-virtual network interfaces (i.e. en0 is selected, while bond0 is not).

DNS Caching

Talos Linux now provides a caching DNS resolver for host workloads (including host networking pods). It can be disabled with:

machine:
  features:
    hostDNS:
      enabled: false

You can also enable dns caching for k8s pods with:

machine:
  features:
    hostDNS:
      enabled: true
      forwardKubeDNSToHost: true

Please note that on running cluster you will have to kill CoreDNS pods for this change to apply.

If you want to can also enable the resolving of member addresses through their host and node names:

machine:
  features:
    hostDNS:
      enabled: true
      resolveMemberNames: true

Extension Services Config

Talos now supports supplying configuration files and environment variables for extension services.
The extension service configuration is a separate config document. An example is shown below:

---
apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: nut-client
configFiles:
  - content: MONITOR ${upsmonHost} 1 remote pass password
    mountPath: /usr/local/etc/nut/upsmon.conf
environment:
  - UPS_NAME=ups

For documentation, see Extension Services Config Files.

Note: The use of environmentFile in extension service spec is now deprecated and will be removed in a future release of Talos.
Use ExtensionServiceConfig instead.

IPTables

Talos Linux now forces kubelet and kube-proxy to use iptables-nft instead of iptables-legacy (xtables) which was the default
before Talos 1.7.0.

Container images based on iptables-wrapper should work without changes, but if there was a direct call to legacy mode of iptables, make sure
to update to use iptables-nft.

Kubernetes Upgrade

The command talosctl upgrade-k8s now supports specifying custom image references for Kubernetes components via --*-image flags.
The default behavior is unchanged, and the flags are optional.

KubeSpan

Talos Linux disables by default a KubeSpan feature to harvest additional endpoints from KubeSpan members.
This feature turned out to be less helpful than expected and caused unnecessary performance issues.

Previous behavior can be restored with:

machine:
  network:
    kubespan:
        harvestExtraEndpoints: true

Logging

Talos Linux now supports setting extra tags when sending logs in JSON format:

machine:
  logging:
    destinations:
      - endpoint: "udp://127.0.0.1:12345/"
        format: "json_lines"
        extraTags:
          server: s03-rack07

Time Sync

Default NTP server was updated to be time.cloudflare.com instead of pool.ntp.org.
Default server is only used if the user does not specify any NTP servers in the configuration.

Talos Linux can now sync to PTP devices (e.g. provided by the hypervisor) skipping the network time servers.
In order to activate PTP sync, set machine.time.servers to the PTP device name (e.g. /dev/ptp0):

machine:
  time:
    servers:
      - /dev/ptp0

OpenNebula

Talos Linux now supports OpenNebula platform.

Platforms

Talos Linux now supports Akamai Connected Cloud provider (platform akamai).

Kubernetes API Server Service Account Key

Talos Linux starting from this release uses RSA key for Kubernetes API Server Service Account instead of ECDSA key to provide better compatibility with external OpenID Connect implementations.

SBC

Talos has split the SBC's (Single Board Computers) into separate repositories.
There will not be any more SBC specific release assets as part of Talos release.

The default Talos Installer image will stop working for SBC's and will fail the upgrade, if used, starting from Talos v1.7.0.

The SBC's images and installers can be generated on the fly using Image Factory or using Imager for custom images, please use ghcr.io/nberlee/imager.
The list of official SBC's images supported by Image Factory can be found in the Overlays repository.

The Turing RK1 SBC-overlay can be found in this repo. The v1.7.1-rk3588 installer tag comes by default with the SBC overlay.

Secure Boot Image

Talos Linux now provides a way to configure systemd-boot ISO 'secure-boot-enroll' option while generating a SecureBoot ISO image:

output:
    kind: iso
    isoOptions:
        sdBootEnrollKeys: force # default is still if-safe
    outFormat: raw

Syslog

Talos Linux now starts a basic syslog receiver listening on /dev/log.
The receiver can mostly parse both RFC3164 and RFC5424 messages and writes them as JSON formatted message.
The logs can be viewed via talosctl logs syslogd.

This is mostly implemented for extension services that log to syslog.

UBSAN Cilium Kernel patch

Talos 1.7 includes UBSAN, which leads to dmesg warnings when Cilium initiates due to an array out-of-bound issue. This fork incorporates a fix from kernel-next upstream to address this problem.

Component Updates

Linux: 6.6.29
containerd: 1.7.16
etcd: 3.5.11
Kubernetes: 1.30.0
runc: 1.1.12
Flannel: 0.25.1
Turing-RK1: arm-trusted-firmware: 2.10.3
Turing-RK1: Rockchip 3588 DDR binary blob: 1.16

Talos is built with Go 1.22.2.

Hardware Watchdog Timers

Talos Linux now supports hardware watchdog timers configuration.
If enabled, and the machine becomes unresponsive, the hardware watchdog will reset the machine.

The watchdog can be enabled with the following configuration document:

apiVersion: v1alpha1
kind: WatchdogTimerConfig
device: /dev/watchdog0
timeout: 3m0s

Contributors

  • Andrey Smirnov
  • Noel Georgi
  • Dmitriy Matrenichev
  • Utku Ozdemir
  • Andrey Smirnov
  • Artem Chernyshev
  • Dmitry Sharshakov
  • Justin Garrison
  • Radosław Piliszek
  • Spencer Smith
  • Anthony ARNAUD
  • Steve Francis
  • Anastasios Papagiannis
  • Andrei Kvapil
  • Andrian Zubovic
  • AvnarJakob
  • Cas de Reuver
  • Christian Mohn
  • Christian WALDBILLIG
  • Dennis Marttinen
  • Dmitry Sharshakov
  • Drew Hess
  • Evan Johnson
  • ExtraClock
  • Fabiano Fidêncio
  • Henno Schooljan
  • Hervé Werner
  • JJGadgets
  • Jacob McSwain
  • Jean-Tiare Le Bigot
  • Jonomir
  • Kai Hanssen
  • Konrad Eriksson
  • Louis SCHNEIDER
  • Matthieu S
  • Michael Stephenson
  • Nico Berlee
  • Niklas Wik
  • Pip Oomen
  • Saiyam Pathak
  • Sebastiaan Gerritsen
  • Sebastian Gaiser
  • Serge Logvinov
  • Tim Jones
  • bri
  • ebcrypto
  • edwinavalos
  • fazledyn-or
  • goodmost
  • james-dreebot
  • pardomue
  • shurkys
  • stereobutter
  • Igor Rzegocki

Changes

248 commits

Changes from siderolabs/pkgs

3 commits

Dependency Changes

  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.0 -> v1.11.1
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0 -> v1.5.1
  • github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.0.0 -> v1.1.0
  • github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.0.1 -> v1.1.0
  • github.com/alexflint/go-filemutex v1.3.0 new
  • github.com/aws/aws-sdk-go-v2/config v1.25.6 -> v1.27.10
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.5 -> v1.16.1
  • github.com/aws/aws-sdk-go-v2/service/kms v1.30.1 new
  • github.com/aws/smithy-go v1.17.0 -> v1.20.2
  • github.com/beevik/ntp v1.3.0 -> v1.3.1
  • github.com/cenkalti/backoff/v4 v4.2.1 -> v4.3.0
  • github.com/containerd/cgroups/v3 v3.0.2 -> v3.0.3
  • github.com/containernetworking/plugins v1.3.0 -> v1.4.1
  • github.com/coredns/coredns v1.11.2 new
  • github.com/cosi-project/runtime v0.3.19 -> v0.4.1
  • github.com/distribution/reference v0.5.0 -> v0.6.0
  • github.com/docker/docker v24.0.7 -> v26.0.0
  • github.com/docker/go-connections v0.4.0 -> v0.5.0
  • github.com/foxboron/go-uefi 18b9ba9cd4c3 -> 48be911532c2
  • github.com/gdamore/tcell/v2 v2.6.0 -> v2.7.4
  • github.com/google/go-containerregistry v0.16.1 -> v0.19.1
  • github.com/google/go-tpm v0.9.0 -> ee6cbcd136f8
  • github.com/google/nftables v0.1.0 -> v0.2.0
  • github.com/google/uuid v1.4.0 -> v1.6.0
  • github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 new
  • github.com/hetznercloud/hcloud-go/v2 v2.4.0 -> v2.7.0
  • github.com/insomniacslk/dhcp b0416c0f187a -> c728f5dd21c8
  • github.com/jeromer/syslogparser v1.1.0 new
  • github.com/jsimonetti/rtnetlink v1.4.0 -> v1.4.1
  • github.com/klauspost/cpuid/v2 v2.2.7 new
  • github.com/linode/go-metadata v0.2.0 new
  • github.com/mdlayher/kobject 19ca17470d7d new
  • github.com/miekg/dns v1.1.58 new
  • github.com/opencontainers/image-spec v1.1.0-rc4 -> v1.1.0
  • github.com/opencontainers/runtime-spec v1.1.0-rc.1 -> v1.2.0
  • github.com/packethost/packngo v0.30.0 -> v0.31.0
  • github.com/pmorjan/kmod v1.1.0 -> v1.1.1
  • github.com/prometheus/procfs v0.12.0 -> v0.13.0
  • github.com/rivo/tview 33a1d271f2b6 -> a22293bda944
  • github.com/scaleway/scaleway-sdk-go v1.0.0-beta.21 -> v1.0.0-beta.25
  • github.com/siderolabs/crypto v0.4.1 -> v0.4.4
  • github.com/siderolabs/discovery-api v0.1.3 -> v0.1.4
  • github.com/siderolabs/discovery-client v0.1.5 -> v0.1.8
  • github.com/siderolabs/extras v1.6.0-1-g113887a -> v1.7.0-1-gbb76755
  • github.com/siderolabs/gen v0.4.7 -> v0.4.8
  • github.com/siderolabs/go-api-signature v0.3.2 new
  • github.com/siderolabs/go-blockdevice/v2 3265299b0192 new
  • github.com/siderolabs/go-copy v0.1.0 new
  • github.com/siderolabs/go-debug v0.2.3 -> v0.3.0
  • github.com/siderolabs/go-kmsg v0.1.3 -> v0.1.4
  • github.com/siderolabs/go-kubernetes v0.2.8 -> v0.2.9
  • github.com/siderolabs/go-loadbalancer v0.3.2 -> v0.3.3
  • github.com/siderolabs/go-talos-support v0.1.0 new
  • github.com/siderolabs/siderolink v0.3.4 -> v0.3.5
  • github.com/siderolabs/tools v1.6.0-1-g336d248 -> v1.7.0-1-g10b2a69
  • github.com/stretchr/testify v1.8.4 -> v1.9.0
  • github.com/u-root/u-root v0.11.0 -> v0.14.0
  • github.com/ulikunitz/xz v0.5.11 -> v0.5.12
  • go.etcd.io/etcd/api/v3 v3.5.11 -> v3.5.13
  • go.etcd.io/etcd/client/pkg/v3 v3.5.11 -> v3.5.13
  • go.etcd.io/etcd/client/v3 v3.5.11 -> v3.5.13
  • go.etcd.io/etcd/etcdutl/v3 v3.5.11 -> v3.5.13
  • go.uber.org/zap v1.26.0 -> v1.27.0
  • go4.org/netipx 6213f710f925 -> fdeea329fbba
  • golang.org/x/net v0.19.0 -> v0.23.0
  • golang.org/x/oauth2 v0.15.0 -> v0.18.0
  • golang.org/x/sync v0.5.0 -> v0.6.0
  • golang.org/x/sys v0.15.0 -> v0.18.0
  • golang.org/x/term v0.15.0 -> v0.18.0
  • google.golang.org/grpc v1.59.0 -> v1.62.1
  • google.golang.org/protobuf v1.31.0 -> v1.33.0
  • k8s.io/api v0.29.0 -> v0.30.0
  • k8s.io/apimachinery v0.29.0 -> v0.30.0
  • k8s.io/apiserver v0.29.0 -> v0.30.0
  • k8s.io/client-go v0.29.0 -> v0.30.0
  • k8s.io/component-base v0.29.0 -> v0.30.0
  • k8s.io/cri-api v0.29.0 -> v0.30.0
  • k8s.io/klog/v2 v2.110.1 -> v2.120.1
  • k8s.io/kube-scheduler v0.29.0 -> v0.30.0
  • k8s.io/kubectl v0.29.0 -> v0.30.0
  • k8s.io/kubelet v0.29.0 -> v0.30.0
  • k8s.io/pod-security-admission v0.30.0 new
  • github.com/containerd/containerd v1.7.14 -> v1.7.16
  • github.com/siderolabs/pkgs v1.7.0-6-g29106c0 -> v1.7.0-9-g76bd73c
  • github.com/siderolabs/talos/pkg/machinery v1.7.0 -> v1.7.1

Previous release can be found at v1.6.7

Assets 3
Loading