v1.10.0-alpha.3 #10591
Replies: 1 comment 7 replies
-
|
I tried upgrading a v1.9.4 test node to this release using https://factory.talos.dev/?arch=amd64&cmdline-set=true&extensions=-&extensions=siderolabs%2Fxen-guest-agent&platform=nocloud&target=cloud&version=1.10.0-alpha.3; The machine doesn't come up when booting to 1.10.0-alpha.3 first sign of trouble is the DNS resolve cache but the boot process really stops progressing after starting /sbin/dashboard. As I noticed that the xen-guest-agent got bumped to 0.5.0-dev I tried upgrading without the xen extension (https://factory.talos.dev/?arch=amd64&board=undefined&cmdline-set=true&extensions=-&platform=nocloud&secureboot=undefined&target=cloud&version=1.10.0-alpha.3) but that yielded the same result. |
Beta Was this translation helpful? Give feedback.
-
|
Same just happend to me for a new cluster on hetzner. Machine Confversion: v1alpha1
debug: false
persist: true
machine:
type: controlplane
token: xxx
ca:
crt: xxx
key: xxx
certSANs: [deleted]
kubelet:
image: ghcr.io/siderolabs/kubelet:v1.33.0
extraArgs:
cloud-provider: external
rotate-server-certificates: "true"
extraMounts:
- destination: /var/openebs/local
type: bind
source: /var/openebs/local
options:
- rbind
- rshared
- rw
extraConfig:
failSwapOn: true
featureGates:
UserNamespacesPodSecurityStandards: true
UserNamespacesSupport: true
maxParallelImagePulls: 8
maxPods: 220
nodeStatusMaxImages: 100
readOnlyPort: 0
serializeImagePulls: false
serverTLSBootstrap: true
defaultRuntimeSeccompProfileEnabled: true
nodeIP:
validSubnets:
- 10.0.0.0/16
- 2000::/3
disableManifestsDirectory: true
network:
nameservers:
- 1.1.1.1
- 1.0.0.1
- 2606:4700:4700::1111
- 2606:4700:4700::1001
extraHostEntries:
- ip: 10.0.0.10
aliases: [deleted]
kubespan:
enabled: true
install:
disk: /dev/sda
image: ghcr.io/siderolabs/installer:v1.9.2
wipe: false
sysctls:
kernel.pid_max: "4194304"
kernel.randomize_va_space: "2"
net.ipv4.icmp_echo_ignore_broadcasts: "1"
net.ipv4.icmp_ignore_bogus_error_responses: "1"
net.ipv4.ip_local_port_range: 10240 65535
net.ipv4.tcp_fastopen: "1"
net.ipv4.tcp_rfc1337: "1"
net.ipv4.tcp_syncookies: "1"
user.max_user_namespaces: "15000"
vm.nr_hugepages: "1024"
vm.overcommit_memory: "1"
features:
rbac: true
stableHostname: true
kubernetesTalosAPIAccess:
enabled: true
allowedRoles:
- os:reader
- os:etcd:backup
allowedKubernetesNamespaces:
- kube-system
- cluster-autoscaler
apidCheckExtKeyUsage: true
diskQuotaSupport: true
kubePrism:
enabled: true
port: 7445
hostDNS:
enabled: true
forwardKubeDNSToHost: true
resolveMemberNames: true
nodeLabels:
openebs.io/engine: mayastor
pool: talos-controlplane-amd64 |
Beta Was this translation helpful? Give feedback.
-
|
yes, please, and attach the |
Beta Was this translation helpful? Give feedback.
-
|
Okay, I whished I would have created the support bundle before I did a retry. Seems like it is a sporadic issue and now does not trigger anymore. I will definitely try again and if it happens I will created the matching issue. Issue in #10845 |
Beta Was this translation helpful? Give feedback.
-
|
Just upgraded my controlplane to v1.10.0 and im facing the same issue
|
Beta Was this translation helpful? Give feedback.
-
|
Seeing the same issue on v1.10.0 nocloud + proxmox (8.2.2): Have gone back to 1.9.5 for time being. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Talos 1.10.0-alpha.3 (2025-03-24)
Welcome to the v1.10.0-alpha.3 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
auditd
Kernel parameter
talos.auditd.disabled=1can be used to disable Talos built-inauditdservice.cgroups v1
Talos Linux no longer supports
cgroupsv1when running in non-container mode.The kernel argument
talos.unified_cgroup_hierarchyis now ignored.Disk Image
Talos starting with 1.10 will have disk images that will use GRUB only for legacy BIOS and systemd-boot for modern UEFI systems.
On first boot Talos determines the boot method and will wipe the unused bootloader.
Secureboot disk-images will be sd-boot only.
For ARM64 imager will still generate GRUB bootloader for Talos < 1.10 and for Talos >= 1.10 all ARM64 boot assets will use systemd-boot.
Imager supports overwriting bootloader when generating a disk image via the Imager profile
outputoption.Eg:
Driver Rebind
Talos 1.10 now supports a new machine config document named
PCIDriverRebindConfigthat allows rebinding the driver of a PCI device to a different target driver.See the documentation for more information.
Ethernet
Talos now provides
ethtool-style Ethernet low-level configuration vianetwork/EthernetConfigdocuments.Current status of the interface can be read by
talosctl get ethernetstatus.Machine Install Extensions
.machine.install.extensionswill have no effect starting from Talos 1.10, the machine config document field is still kept so upgrades from older versions are possible.Use Boot Assets instead.
Extra Kernel Args
Talos 1.10 on fresh install on UEFI systems will now use systemd-boot and UKIs (Unified Kernel Images)[https://uapi-group.org/specifications/specs/unified_kernel_image/].
This means the kernel command line arguments are part of the UKI and cannot be modified without an upgrade to a new UKI.
Upgrades to Talos 1.10 will preseve the existing bootloader (GRUB for non-secureboot) and sd-boot for Secureboot and this change will have no effect.
To build a boot asset with extra kernel arguments whether an
installeror a boot image use either Image Factory orImager.
This means kernel arguments not part of the UKI will not be preserved across updates and a proper installer image generated via Imager Factory or Imager is required.
Ingress Firewall
Talos Ingress Firewall now filters access to Kubernetes NodePort services correctly.
iSCSI Initiator
Talos now generates
/etc/iscsi/initiatorname.iscsifile based on the node identity which is tied to the lifecycle of the node.If using
iscsi-toolsextension, starting with Talos 1.10 would have a more deterministic IQN for the initiator node.Make sure to update any iSCSI targets to use the new initiator IQN.
The iqn can be read by
talosctl read /etc/iscsi/initiatorname.iscsiISO
Talos starting with 1.10 will have ISO's that will use GRUB only for legacy BIOS and systemd-boot for modern UEFI systems.
kube-apiserver Authorization Config
When using
.cluster.apiServer.authorizationConfigthe user provided order for the authorizers is honoured andNodeandRBACauthorizers are always added to the end if not explicitly specified.Eg: If user provides only
Webhookauthorizer, the final order will beWebhook,Node,RBAC.To provide a specific order for
NodeorRBACexplicitly, user can provide the authorizer in the order they want.Eg:
Usage of
authorization-modeCLI argument will not support this form of customization.NVMe NQN
Talos now generates
/etc/nvme/hostnqnand/etc/nvme/hostidfiles based on the node identity which is tied to the lifecycle of the node.The NQN can be read by
talosctl read /etc/nvme/hostnqnFully bootstrapped builds
Talos 1.10 is built with a toolchain based on [Stageˣ], which is a project building fully bootstrapped software.
This change increases reproducibility, auditability and security of Talos builds.
This also changes Talos root filesystem structure for unified /usr, with other directories symlinking to /usr/bin and /usr/lib.
System extensions must move their directories accordingly for 1.10.
Component Updates
Talos is built with Go 1.24.1.
Contributors
Changes
271 commits
.machine.install.extensionsethtool-like supportpreserveflag for Talos 1.8+preserveflag for Talos 1.8+talosctl debug air-gappedconfigfsFailed to initialize SELinux labeling handleudev errorRegistriesConfigControllerChanges since v1.10.0-alpha.2
50 commits
.machine.install.extensionsChanges from siderolabs/crypto
1 commit
Changes from siderolabs/discovery-api
1 commit
Changes from siderolabs/discovery-client
1 commit
Changes from siderolabs/extras
7 commits
.kres.yamldefaultsChanges from siderolabs/gen
1 commit
Changes from siderolabs/go-circular
2 commits
Changes from siderolabs/go-debug
1 commit
Changes from siderolabs/go-kubeconfig
1 commit
Changes from siderolabs/go-kubernetes
3 commits
Changes from siderolabs/go-loadbalancer
1 commit
upstream.Listandloadbalancer.TCPto Go 1.23Changes from siderolabs/go-pointer
1 commit
Changes from siderolabs/go-talos-support
1 commit
Changes from siderolabs/pkgs
69 commits
.kres.yamldefaultsChanges from siderolabs/proto-codec
1 commit
Changes from siderolabs/siderolink
2 commits
Changes from siderolabs/tools
24 commits
.kres.yamldefaultsDependency Changes
Previous release can be found at v1.9.0
Images
This discussion was created from the release v1.10.0-alpha.3.
Beta Was this translation helpful? Give feedback.
All reactions