chore: backports for v1.14.0 - #14217
Merged
Merged
Conversation
Enable Cilium to work in enforcing mode Fixes siderolabs#13807 Signed-off-by: Dmitrii Sharshakov <dmitry.sharshakov@siderolabs.com> (cherry picked from commit 00ec337)
This should be defense-in-depth, as the untar is usually passed trusted input - either an extension image, or the Talos Read API result, but it's better to stay on the safe side, and protect from malicious tar structure by restricting the extraction to the provided root. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 9c747cb)
In containerd v4 config format, the `[metrics]` was deprecated - updat to the new name in the examples. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit f48e688)
Fixes siderolabs#12860 The Linux kernel ships VLAN tags on ingress frames, so use gopacket's feature to re-insert them. This has limitations though (mostly on gopacket's side), but still better than current behavior: * packets with VLAN tag 0 will not have header re-attached * packets will be with 802.1q frames no matter what the actual VLAN tag was Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit e489f95)
SELinux label was applied unconditionally on mount, ignoring the same read-only/detached/external exclusions already used for target settings. For a read-only existing volume this attempted to relabel a target it must not touch. Unify both checks under one shouldUpdateTargetSettings gate. Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit 1bb6e1f)
shanduur
force-pushed
the
backports/v1.14.0
branch
from
September 2, 2026 10:15
7195ff4 to
e04a82c
Compare
Allow extensions to opt out of the container rootfs and execute an absolute entrypoint directly on the Talos host. Keep container mode as the default and reject container-only mounts and security options for host services. Add service validation and tests and include the SELinux policy and context files required for libvirt-managed guests. Signed-off-by: Noel Georgi <git@frezbo.dev> (cherry picked from commit 86d76b0)
They were introduced long ago to fight the problem of "dead" connections, but: * it breaks on live, but idle connections as Talos: server-side drops the connection as it goes above the server-side budget of keepalives * it applies only to the connection to the endpoint, not to the actual connection to the node (when going via proxying), or to the connection e.g. to Omni if using against Talos cluster behind Omni * I don't see problems in my smoke tests today - connections are closed gracefully, and the client sees it * Talos integration tests were fine without it always (when using direct API calls) The first point is the real issue: image pull process might take a while for images first created by the Image Factory, and the Talos API will sit idle while waiting for the image to start pulling, while this aggressive keep-alive actually kills the perfectly valid API call by blowing up the server-side budget. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 4f7f5c2)
Update multipath notes. Signed-off-by: Noel Georgi <git@frezbo.dev> (cherry picked from commit f25b4a3)
The etcd snapshot upload truncated the snapshot file in place, and removed it when the upload failed. The etcd recovery reads that same file, and it runs after the bootstrap API has already returned success. This way, an upload repeated during a running recovery cut the snapshot short and left a partial etcd data directory behind, and every bootstrap after that got rejected. Write the upload to a temporary file next to the snapshot and move it into place only once it is complete. A running recovery keeps reading the snapshot it started with, and a failed upload removes only its own temporary file. Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com> (cherry picked from commit 48fe469)
Aligns the filter enablement/disablement behavior with the talosctl dashboard resource browser (F3). That is, for the log filter page: - Pressing `/` opens the filter input - When the input is opened, it can be hidden and kept applied (enabled) by pressing `Enter`. - When the filter is enabled, it can be disabled by re-opening the filter input (press `/`), and then pressing `Esc`. Also documents the filter option in the header "Logs" horizontal line (similar to the resource view). Signed-off-by: Maja Bojarska <maja.bojarska@siderolabs.com> (cherry picked from commit ba2d9a7)
Bump kubernetes to 1.37.0 See https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md Signed-off-by: Noel Georgi <git@frezbo.dev> (cherry picked from commit abff95d)
Talos `/etc` is a bind mount, so we need to explicitly mount it up for hostns, otherwise `EtcFileConfig` files would be missed. This means we can drop the etc seeding. Signed-off-by: Noel Georgi <git@frezbo.dev> (cherry picked from commit 0179b80)
OpenFile with the full mode (setuid/setgid/sticky) can fail inside the chroot/imager extraction path. Apply only the permission bits at creation and let the subsequent Chmod set the special bits. Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit 770e5cd)
The boot timeout was evaluated before the syncer switch, which clears timeSynced when it restarts the syncer on an NTS change. A timeout that fired first is discarded, and on a boot nothing reconciles this controller again, so the node never reports time as synced and etcd never starts. Signed-off-by: Sacha Weatherstone <sachaw100@hotmail.com> Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit b46c53e)
SPD5118 enables temperature monitoring on DDR5 DIMMs. Signed-off-by: Dmitrii Sharshakov <dmitry.sharshakov@siderolabs.com> (cherry picked from commit ea5484b)
Rekor 1.5.4 transitively drops the vulnerable golang.org/x/crypto/openpgp usage, so GO-2026-5932 no longer needs suppression. Refresh GO-2026-4736 TTL and clean up indirect dependencies (go-openapi, relic v8, prometheus, google cloud libs) and remove unused blang/semver. Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit 1b1905a)
`worker()` pre-initialized `.machine.registries.mirrors` to an empty
map before calling `generateRegistryConfigs`, which reassigns the whole
`RegistriesConfig` on legacy contracts and leaves it untouched on
multi-doc ones. The two contract predicates are disjoint
(`KubernetesAlternateImageRegistries` covers only v1.2,
`MultidocNetworkConfigSupported` starts after v1.11), so the block never
contributed a mirror — it only left a non-nil empty map behind.
The commented encoder's `isEmpty` falls back to `reflect.Value.IsZero()`
for structs, which is false for a struct holding a non-nil empty map, so
`talosctl gen config` rendered a spurious `registries: {}` in
worker.yaml while controlplane.yaml, which has no such block, stayed
clean. `--with-docs=false --with-examples=false` hid it because plain
`yaml.Marshal` recurses into the struct and treats it as zero.
Closes siderolabs#14161
Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>
(cherry picked from commit 083e7f9)
Fixes issue siderolabs#14164 Based on siderolabs@a705a38 63bd62c (cherry-picked to release-1.14 as 7ac3cad), introduces RTMGRP_IPV6_ROUTE to the controller's RtNetlink watcher, which triggers the controller's wake-ups. As reported in pull siderolabs#14085 (siderolabs#14085), before subscribing to RTMGRP_IPV6_ROUTE, deleting an IPv6 route out-of-band (not through Talos config documents), would leave the actual route missing until the subsequent controller wake-up. This however, combined with how Linux implicitly handles the scope field for the IPv6 family, created an unwanted side effect, resulting in the controller endlessly churning IPv6 route creation. This churn rate waas capped only by the RateLimitedTrigger, which is using the default configuration limits of 10 events/sec (with a burst of 5). This perfectly matches the observed behavior of IPv6 routes reconciling every 100ms. Now for how the kernel handles route scope in the IPv6 family. The kernel accepts any scope on RTM_NEWROUTE, regardless of family type. However, the route scope is an IPv4-only concept, and this field is dropped when an IPv6 route is being stored into the forwarding table (FIB). The IPv6 FIB (fib6_info struct) doesn't even have an equivalent scope field. Then, when we read the routes back in the RouteSpecController, with the intent of comparing the actual route's scope against the desired one (as defined by the RouteSpec documents), the kernel always fills the returned route's scope with RT_SCOPE_UNIVERSE (nethelpers.ScopeGlobal), in rt6_fill_node(). Then, if the IPv6 route's desired scope is not set to ScopeGlobal, the actual route is considered out of sync, and the controller writes the route. Writing the IPv6 route causes a RTMGRP_IPV6_ROUTE event to be emitted, our RtNetlink watcher is triggered, which wakes our controller, which leads to the same reconciliation, which completes the cycle and results in the endless IPv6 route creation loop. To mitigate the above, we must only assert the scope for non-IPv6 routes. Co-authored-by: Sacha Trémoureux <sacha@tremoureux.fr> Signed-off-by: Maja Bojarska <maja.bojarska@siderolabs.com> (cherry picked from commit f7065d3)
Allow host extension services to run bounded commands before graceful node teardown while their dependencies and D-Bus are still available. This prevents surviving child processes from blocking EPHEMERAL teardown without changing API stop or restart semantics. Run hooks for reboot, reset, shutdown, staged upgrade, and upgrade. Skip forced and maintenance paths where graceful cleanup is unavailable. Signed-off-by: Noel Georgi <git@frezbo.dev> (cherry picked from commit bfb8dfc)
ConfigStatus.Version only feeds the kube-apiserver static pod, through the `talos.dev/config-file-version` annotation. Mixing the SchedulerConfig resource version into it meant every scheduler change rewrote the kube-apiserver manifest, so the scheduler phase of `talosctl upgrade-k8s` restarted the apiserver too. That phase watches `k8s-app = kube-scheduler` only, so it moved on to the next control plane node while the apiserver was still starting, and all apiservers could end up unready at once. The scheduler pod carries its own SchedulerConfig version in `talos.dev/config-version`, so it still restarts when its config changes. Closes siderolabs#14152 Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit a8c09fb)
Reduce the noise. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 6f7b08a)
With this fix, it now looks as expected: ``` lrwxrwxrwx 1 root root 17 Aug 31 14:58 libmount.so -> libmount.so.1.1.0 lrwxrwxrwx 1 root root 17 Aug 31 14:58 libmount.so.1 -> libmount.so.1.1.0 -rwxr-xr-x 1 root root 501904 Aug 31 14:58 libmount.so.1.1.0 ``` Previously all three files were copies of the same file due to the way Dockerfile `COPY` directive works with globs. Copy the whole directory instead. The copies were compressed away with the squashfs, but still this should be more clean and proper. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit e434671)
See https://github.com/cosi-project/runtime/releases/tag/v1.16.3 Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 6b1d184)
Protect some META keys which are completely owned by Talos itself to be not writeable via the API. Also block writes for zero value, as it used internally in the META format and it will provide inconsistent output. Add integration tests. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit d5f53ed)
Increase parallelism to 8 instances, and reduce a bit the time race detector sleeps after the test finishes (which is the price paid for each test package, and we have many). Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit d970ebc)
The output to tview might be re-processed by tview for its own color tags, so ensure any input data is escaped before drawn into tview. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 6ee4612)
majabojarska
approved these changes
Sep 2, 2026
smira
approved these changes
Sep 2, 2026
smira
reviewed
Sep 2, 2026
Member
There was a problem hiding this comment.
Suggested change
| pre_release = false |
shanduur
added
integration/aws-arm64
Mark release from "prerelease" to "stable" Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>
shanduur
force-pushed
the
backports/v1.14.0
branch
from
September 3, 2026 05:27
7a25d57 to
ff772d6
Compare
Member
Author
|
/m |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Containers
machinedAccess: trueprovidesrole.All#14206rshared#14204Updates:
v1.14.0-15-g2f03590v1.14.0-5-g87316ca