v0.11.0-alpha.1

[smira]

Talos 0.11.0-alpha.1 (2021-06-18)

Welcome to the v0.11.0-alpha.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/talos-systems/talos/issues.

Default to Bootstrap workflow

The init.yaml is no longer an output of talosctl gen config.
We now encourage using the bootstrap API, instead of init node types, as we
intend on deprecating this machine type in the future.
The init.yaml and controlplane.yaml machine configs are identical with the
exception of the machine type.
Users can use a modified controlplane.yaml with the machine type set to
init if they would like to avoid using the bootstrap API.

Component Updates

• containerd was updated to 1.5.2
• Linux kernel was updated to 5.10.38

CoreDNS

Added the flag cluster.coreDNS.disabled to coreDNS deployment during the cluster bootstrap.

Legacy BIOS Support

Added an option to the machine.install section of the machine config that can enable marking MBR partition bootable
for the machines that have legacy BIOS which does not support GPT partitioning scheme.

Multi-arch Installer

Talos installer image (for any arch) now contains artifacts for both amd64 and arm64 architecture.
This means that e.g. images for arm64 SBCs can be generated on amd64 host.

Networking Configuration

Talos networking configuration was completely rewritten to be based on controllers
and resources.
There are no changes to the machine configuration, but any update to .machine.network can now
be applied in immediate mode (without a reboot).
Talos should be setting up network configuration much faster on boot now, not blocking on DHCP for unconfigured
interfaces and skipping the reset network step.

Talos API RBAC

Limited RBAC support in Talos API is now enabled by default for Talos 0.11.
Default talosconfig has os:admin role embedded in the certificate so that all the APIs are available.
Certificates with reduced set of roles can be created with talosctl config new command.

When upgrading from Talos 0.10, RBAC is not enabled by default. Before enabling RBAC, generate talosconfig with
os:admin role first to make sure that administrator still has access to the cluster when RBAC is enabled.

List of available roles:

• os:admin role enables every Talos API
• os:reader role limits access to read-only APIs which do not return sensitive data
• os:etcd:backup role only allows talosctl etcd snapshot API call (for etcd backup automation)

Contributors

• Andrey Smirnov
• Alexey Palazhchenko
• Artem Chernyshev
• Jorik Jonker
• Spencer Smith
• Andrew Rynhard
• Serge Logvinov
• Andrew LeCody
• Kevin Hellemun
• Boran Car
• Brandon Nason
• Gabor Nyiri
• Joost Coelingh
• Lance R. Vick
• Lennard Klein
• Seán C McCord
• Sébastien Bernard
• Sébastien Bernard

Changes

143 commits

• e13d905c2 release(v0.11.0-alpha.1): prepare release
• 70ac771e0 fix: use localhost API server endpoint for internal communication
• a941eb7da feat: improve security of Kubernetes control plane components
• 3aae94e53 feat: provide Kubernetes nodename as a COSI resource
• 06209bba2 chore: update RBAC rules, remove old APIs
• 9f24b519d chore: remove bootkube check from cluster health check
• 4ac9bea27 fix: stop etcd client logs from going to the server console
• f63ab9dd9 feat: implement talosctl config new command
• fa15a6687 fix: don't enable RBAC feature in the config for Talos < 0.11
• 2dc27d996 fix: do not format state partition in the initialize sequence
• b609f33cd fix: update networking stack after Equnix Metal testing
• 243a3b53e fix: separate healthy and unknown flags in the service resource
• 1a1378be1 fix: update retry package with a fix for errors.Is
• cb83edd7f fix: wait for the network to be ready in mainteancne mode
• 96f89071c feat: update controller-runtime logs to console level on config.debug
• 973069b61 feat: support NFS 4.1
• 654dcad47 chore: bump dependencies via dependabot
• d7394457d fix: don't treat ethtool errors as fatal
• f2ae9cd0c feat: replace networkd with new network implementation
• caec3063c fix: do not complain about empty roles
• 11918a110 docs: update community meeting time
• aeddb9c09 feat: implement platform config controller (hostnames)
• 1ece334da feat: implement controller which runs network operators
• 744ea8a5d fix: do not add bootstrap contents option if tail events is not 0
• 5029edfb7 fix: overwrite nodes in the gRPC metadata
• 6a35c8f11 feat: implement virtual IP (shared IP) network operator
• 0f3b83803 chore: expose WatchRequest in the resources client
• 11e258b15 feat: implement operator configuration controller
• ce3815e75 feat: implement DHCP6 operator
• f010d99af feat: implement operator framework with DHCP4 as the first example
• f93c9c8fa feat: bring unconfigured links with link carrier up by default
• 02bd657b2 feat: implement network.Status resource and controller
• da329f00a feat: enable RBAC by default
• 0f168a880 feat: add configuration for enabling RBAC
• e74f789b0 feat: implement EtcFileController to render files in /etc
• 5aede1a83 fix: prefer extraConfig over OVF env, skip empty config
• 5ad314fe7 feat: implement basic RBAC interceptors
• c031be813 chore: use Go 1.16.5
• 8b0763f6a chore: bump dependencies via dependabot
• 8b8de11d9 feat: implement new controllers for hostname, resolvers and time servers
• 24859b141 docs: update Rpi4 firmware guide
• 62c702c4f fix: remove conflicting etcd member on rejoin with empty data directory
• ff62a5998 fix: drop into maintenance mode if config URL is none (metal)
• 14e696d06 feat: update COSI runtime and add support for tail in the Talos gRPC
• a71053fcd feat: default to bootstrap workflow
• 76aac4bb2 feat: implement CPU and Memory stats controller
• 8f90c6a8e feat: parse Talos-specific cmdline params
• ed10e139c feat: implement NodeAddress controller
• 33db8857a fix: use COSI runtime DestroyReady input type
• 6e7753639 refactor: rename *.Status() to *.TypedSpec() in the resources
• 97627061d docs: set static IP on ISO install mode
• 5811f4dda feat: implement link (interface) controllers
• 046b229b1 chore: skip building multi-arch installer for race-enabled build
• 73fbb4b52 fix: only fetch machine uuid if it's not set
• f112a540b fix: clean up stale snapshots on container start
• c036b9494 chore: bump dependencies
• a4d67a018 feat: add the ability to disable CoreDNS
• 76dbfb369 feat: add ability to mark MBR partition bootable
• e0f5b1e20 chore: split mgmt/gen.go into several files
• fad1b4f1f chore: fix go generate for the machinery
• 1117294ad release(v0.11.0-alpha.0): prepare release
• c09629466 chore: prepare for 0.11 release series
• 723597657 feat: enable GORACE=halt_on_panic=1 in machined binary
• 0acb04ad7 feat: implement route network controllers
• f5bf88a4c feat: create certificates with os:admin role
• 1db301edf feat: switch controller-runtime to zap.Logger
• f7cf64d42 fix: add talos.config to the vApp Properties in VMware OVA
• 209527ecc docs: add AMIs for Talos 0.10.3
• 59cfd312c chore: bump dependencies via dependabot
• 1edb20cf9 feat: extract config generation
• af77c2956 docs: update wirguard guide
• 4fe691214 test: better talosctl ls tests
• 04ddda962 feat: update containerd to 1.5.2, runc to 1.0.0-rc95
• 49c7276b1 chore: fix markdown linting
• 7270495ac docs: add mayastor quickstart
• d3d9112f2 docs: fix spelling/grammar in What's New for Talos 0.9
• 82804414f test: provide a way to force different boot order in provision library
• a1c0e99a1 docs: add guide for deploying metrics-server
• 6bc6658b5 feat: update containerd to 1.5.1
• c6567fae9 chore: dependabot updates
• 61ccbb3f5 chore: keep debug symbols in debug builds
• 1ce362e05 docs: update customizing kernel build steps
• a26174b54 fix: properly compose pattern and header in etcd members output
• 0825cf11f fix: stop networkd and pods before leaving etcd on upgrade
• bed6b15d6 fix: properly populate AllowSchedulingOnMasters option in gen config RPC
• 071f04456 feat: implement AddressSpec handling
• 76e38b7b8 feat: update Kubernetes to 1.21.1
• 9b1338d98 chore: parse "boolean" variables
• c81cfb216 chore: allow building with debug handlers
• c9651673b feat: update go-smbios library
• 95c656fb7 feat: update containerd to 1.5.0, runc to 1.0.0-rc94
• db9c35b57 feat: implement AddressStatusController
• 1cf011a80 chore: bump dependencies via dependabot
• e3f407a1d fix: properly pass disk type selector from config to matcher
• 66b2b4505 feat: add resources and use HTTPS checks in control plane pods
• 4ffd7c0ad fix: stop networkd before leaving etcd on 'reset' path
• 610d38d30 docs: add AMIs for 0.10.1, collapse list of AMIs by default
• 807497ec2 chore: make conformance pipeline depend on cron-default
• 3c1213596 feat: implement LinkStatusController
• 0e8de0469 fix: update go-blockdevice to fix disk type detection
• 4d50a4edd fix: update the way NTP sync uses adjtimex syscall
• 1a85c14a5 fix: avoid data race on CRI pod stop
• 5de8dbc06 fix: repair pine64 support
• 382390973 fix: properly parse matcher expressions
• e54b6b7a3 chore: update dependencies via dependabot
• f2caed0df chore: use extracted talos-systems/go-kmsg library
• 79d804c5b docs: fix typos
• a2bb390e1 feat: deterministic builds
• e480fedff feat: add USB serial drivers
• 79299d761 docs: add Matrix room links
• 1b3e8b09e docs: add survey to README
• 8d51c9bb1 docs: update redirects to Talos 0.10
• 1092c3a50 feat: add Pine64 SBC support
• 63e017543 feat: pull kernel with VMware balloon module enabled
• aeec99d82 chore: remove temporary fork
• 0f49722d0 feat: add --config-patch flag by node type
• a01b1d22d chore: dump dependencies via dependabot
• d540a4a47 fix: bump crypto library for the CSR verification fix
• c3a4173e1 chore: remove security API ReadFile/WriteFile
• 38037131c chore: update wgctrl dependecy
• d9ba0fd01 docs: create v0.11 docs, promote v0.10 docs, add v0.10 AMIs
• 2261d7ed0 fix: use both self-signed and Kubernetes CA to verify Kubelet cert
• a3537a691 docs: update cloud images for Talos v0.9.3
• 5b9ee8617 docs: add what's new for Talos 0.10
• f1107fa3a docs: add survey
• 93623d47f docs: update AWS instructions
• a739d1b8a feat: add support of custom registry CA certificate usage
• 7f468d350 fix: update osType in OVA other3xLinux64Guest"
• 4a184b67d docs: add etcd backup and restore guide
• 5fb38d3e5 chore: refactor Dockerfile for cross-compilation
• a8f1e526b chore: build talosctl for Darwin / Apple Silicon
• eb0b64d31 chore: list specifically for enabled regions
• 669a0cbdc fix: check if OVF env is empty
• da92049c0 chore: use codecov from the build container
• 9996d4b02 chore: use REGISTRY_MIRROR_FLAGS if defined
• 05cbe250c chore: bump dependencies via dependabot
• 9a91142a3 feat: print complete member info in etcd members
• bb40d6dd0 feat: update pkgs version
• e7a9164b1 test: implement talosctl conformance command to run e2e tests
• 6cb266e74 fix: update etcd client errors, print etcd join failures
• 0bd8b0e80 feat: provide an option to recover etcd from data directory copy
• f98185408 chore: fix conform with scopes
• 21018f28c chore: bump website node.js dependencies

Changes since v0.11.0-alpha.0

60 commits

• e13d905c2 release(v0.11.0-alpha.1): prepare release
• 70ac771e0 fix: use localhost API server endpoint for internal communication
• a941eb7da feat: improve security of Kubernetes control plane components
• 3aae94e53 feat: provide Kubernetes nodename as a COSI resource
• 06209bba2 chore: update RBAC rules, remove old APIs
• 9f24b519d chore: remove bootkube check from cluster health check
• 4ac9bea27 fix: stop etcd client logs from going to the server console
• f63ab9dd9 feat: implement talosctl config new command
• fa15a6687 fix: don't enable RBAC feature in the config for Talos < 0.11
• 2dc27d996 fix: do not format state partition in the initialize sequence
• b609f33cd fix: update networking stack after Equnix Metal testing
• 243a3b53e fix: separate healthy and unknown flags in the service resource
• 1a1378be1 fix: update retry package with a fix for errors.Is
• cb83edd7f fix: wait for the network to be ready in mainteancne mode
• 96f89071c feat: update controller-runtime logs to console level on config.debug
• 973069b61 feat: support NFS 4.1
• 654dcad47 chore: bump dependencies via dependabot
• d7394457d fix: don't treat ethtool errors as fatal
• f2ae9cd0c feat: replace networkd with new network implementation
• caec3063c fix: do not complain about empty roles
• 11918a110 docs: update community meeting time
• aeddb9c09 feat: implement platform config controller (hostnames)
• 1ece334da feat: implement controller which runs network operators
• 744ea8a5d fix: do not add bootstrap contents option if tail events is not 0
• 5029edfb7 fix: overwrite nodes in the gRPC metadata
• 6a35c8f11 feat: implement virtual IP (shared IP) network operator
• 0f3b83803 chore: expose WatchRequest in the resources client
• 11e258b15 feat: implement operator configuration controller
• ce3815e75 feat: implement DHCP6 operator
• f010d99af feat: implement operator framework with DHCP4 as the first example
• f93c9c8fa feat: bring unconfigured links with link carrier up by default
• 02bd657b2 feat: implement network.Status resource and controller
• da329f00a feat: enable RBAC by default
• 0f168a880 feat: add configuration for enabling RBAC
• e74f789b0 feat: implement EtcFileController to render files in /etc
• 5aede1a83 fix: prefer extraConfig over OVF env, skip empty config
• 5ad314fe7 feat: implement basic RBAC interceptors
• c031be813 chore: use Go 1.16.5
• 8b0763f6a chore: bump dependencies via dependabot
• 8b8de11d9 feat: implement new controllers for hostname, resolvers and time servers
• 24859b141 docs: update Rpi4 firmware guide
• 62c702c4f fix: remove conflicting etcd member on rejoin with empty data directory
• ff62a5998 fix: drop into maintenance mode if config URL is none (metal)
• 14e696d06 feat: update COSI runtime and add support for tail in the Talos gRPC
• a71053fcd feat: default to bootstrap workflow
• 76aac4bb2 feat: implement CPU and Memory stats controller
• 8f90c6a8e feat: parse Talos-specific cmdline params
• ed10e139c feat: implement NodeAddress controller
• 33db8857a fix: use COSI runtime DestroyReady input type
• 6e7753639 refactor: rename *.Status() to *.TypedSpec() in the resources
• 97627061d docs: set static IP on ISO install mode
• 5811f4dda feat: implement link (interface) controllers
• 046b229b1 chore: skip building multi-arch installer for race-enabled build
• 73fbb4b52 fix: only fetch machine uuid if it's not set
• f112a540b fix: clean up stale snapshots on container start
• c036b9494 chore: bump dependencies
• a4d67a018 feat: add the ability to disable CoreDNS
• 76dbfb369 feat: add ability to mark MBR partition bootable
• e0f5b1e20 chore: split mgmt/gen.go into several files
• fad1b4f1f chore: fix go generate for the machinery

Changes from talos-systems/crypto

7 commits

• 6bc5bb5 chore: remove unused argument
• cd18ef6 feat: add support for several organizations
• 97c888b chore: add options to CSR
• 7776057 chore: fix typos
• 80df078 chore: remove named result parameters
• 15bdd28 chore: minor updates
• 4f80b97 fix: verify CSR signature before issuing a certificate

Changes from talos-systems/extras

1 commit

• 4fe2706 feat: build with Go 1.16.5

Changes from talos-systems/go-blockdevice

3 commits

• 30c2bc3 feat: mark MBR bootable
• 1292574 fix: make disk type matcher parser case insensitive
• b77400e fix: properly detect nvme and sd card disk types

Changes from talos-systems/go-debug

5 commits

• 3d0a6e1 feat: race build tag flag detector
• 5b292e5 feat: disable memory profiling by default
• c6d0ae2 fix: linters and CI
• d969f95 feat: initial implementation
• b2044b7 Initial commit

Changes from talos-systems/go-kmsg

2 commits

• 2edcd3a feat: add initial version
• 53cdd8d chore: initial commit

Changes from talos-systems/go-loadbalancer

3 commits

• a445702 feat: allow dial timeout and keep alive period to be configurable
• 3c8f347 feat: provide a way to configure logger for the loadbalancer
• da8e987 feat: implement Reconcile - ability to change upstream list on the fly

Changes from talos-systems/go-retry

3 commits

• c78cc95 fix: implement errors.Is for all errors in the set
• 7885e16 feat: add ExpectedErrorf
• 3d83f61 feat: deprecate UnexpectedError

Changes from talos-systems/go-smbios

1 commit

• d3a32be fix: return UUID in middle endian only on SMBIOS >= 2.6

Changes from talos-systems/pkgs

18 commits

• 2d51360 feat: support NFS 4.1
• e63e4e9 feat: bump tools for Go 1.16.5
• 1f8af29 feat: update Linux to 5.10.38
• a3a6650 feat: update containerd to 1.5.2
• c70ea44 feat: update runc to 1.0.0-rc95
• db60235 feat: add support for netxen card
• f934187 feat: update containerd to 1.5.1
• e8ed5bc feat: add geneve encapsulation support for openvswitch
• 9f7903c feat: update containerd to 1.5.0, runc to -rc94
• d7c0f70 feat: add AES-NI support for amd64
• b0d9cd2 fix: build zbin utility for both amd64 and arm64
• bb39b97 feat: add IPMI support in kernel
• 1148f9a feat: add DS1307 RTC support for arm64
• 350aa6f feat: add USB serial support
• de9c582 feat: add Pine64 SBC support
• b56f36b feat: enable VMware baloon kernel module
• f87c194 feat: add iPXE build with embedded placeholder script
• a8b9e71 feat: add cpu scaling for rpi

Changes from talos-systems/tools

1 commit

• c8c2a18 feat: update Go to 1.16.5

Dependency Changes

• github.com/aws/aws-sdk-go v1.27.0 new
• github.com/containerd/cgroups 4cbc285b3327 -> v1.0.1
• github.com/containerd/containerd v1.4.4 -> v1.5.2
• github.com/containerd/go-cni v1.0.1 -> v1.0.2
• github.com/containerd/typeurl v1.0.1 -> v1.0.2
• github.com/coreos/go-iptables v0.5.0 -> v0.6.0
• github.com/cosi-project/runtime 10d6103c19ab -> ca95c7538d17
• github.com/docker/docker v20.10.4 -> v20.10.7
• github.com/emicklei/dot v0.15.0 -> v0.16.0
• github.com/fatih/color v1.10.0 -> v1.12.0
• github.com/google/go-cmp v0.5.5 -> v0.5.6
• github.com/google/gofuzz v1.2.0 new
• github.com/googleapis/gnostic v0.5.5 new
• github.com/grpc-ecosystem/go-grpc-middleware v1.2.2 -> v1.3.0
• github.com/hashicorp/go-getter v1.5.2 -> v1.5.3
• github.com/imdario/mergo v0.3.12 new
• github.com/insomniacslk/dhcp cc9239ac6294 -> fb4eaaa00ad2
• github.com/jsimonetti/rtnetlink 1b79e63a70a0 -> b34cb89a106b
• github.com/magiconair/properties v1.8.5 new
• github.com/mattn/go-isatty v0.0.12 -> v0.0.13
• github.com/mdlayher/arp f72070a231fc new
• github.com/mdlayher/ethtool 2b88debcdd43 new
• github.com/mdlayher/netlink v1.4.0 -> v1.4.1
• github.com/mdlayher/raw 51b895745faf new
• github.com/mitchellh/mapstructure v1.4.1 new
• github.com/opencontainers/runtime-spec 4d89ac9fbff6 -> e6143ca7d51d
• github.com/pelletier/go-toml v1.9.0 new
• github.com/rivo/tview 8a8f78a6dd01 -> 807e706f86d1
• github.com/rs/xid v1.2.1 -> v1.3.0
• github.com/sirupsen/logrus v1.8.1 new
• github.com/spf13/afero v1.6.0 new
• github.com/spf13/cast v1.3.1 new
• github.com/spf13/viper v1.7.1 new
• github.com/talos-systems/crypto 39584f1b6e54 -> 6bc5bb50c527
• github.com/talos-systems/extras v0.3.0 -> v0.3.0-1-g4fe2706
• github.com/talos-systems/go-blockdevice 1d830a25f64f -> 30c2bc3cb62a
• github.com/talos-systems/go-debug 3d0a6e1bf5e3 new
• github.com/talos-systems/go-kmsg v0.1.0 new
• github.com/talos-systems/go-loadbalancer v0.1.0 -> v0.1.1
• github.com/talos-systems/go-retry b9dc1a990133 -> c78cc953d9e9
• github.com/talos-systems/go-smbios fb425d4727e6 -> d3a32bea731a
• github.com/talos-systems/pkgs v0.5.0-1-g5dd650b -> v0.6.0-alpha.0-8-g2d51360
• github.com/talos-systems/talos/pkg/machinery 8ffb559 -> 000000000000
• github.com/talos-systems/tools v0.5.0 -> v0.5.0-1-gc8c2a18
• github.com/vishvananda/netns 2eb08e3e575f new
• github.com/vmware-tanzu/sonobuoy v0.20.0 -> v0.51.0
• github.com/vmware/govmomi v0.24.0 -> v0.26.0
• go.etcd.io/etcd/api/v3 v3.5.0-alpha.0 -> v3.5.0-rc.1
• go.etcd.io/etcd/client/pkg/v3 v3.5.0-rc.1 new
• go.etcd.io/etcd/client/v3 v3.5.0-alpha.0 -> v3.5.0-rc.1
• go.etcd.io/etcd/etcdutl/v3 v3.5.0-rc.1 new
• go.uber.org/zap v1.17.0 new
• golang.org/x/net e18ecbb05110 -> abc453219eb5
• golang.org/x/oauth2 81ed05c6b58c new
• golang.org/x/sys 77cc2087c03b -> ebe580a85c40
• golang.org/x/term 6a3ed077a48d -> a79de5458b56
• golang.zx2c4.com/wireguard/wgctrl bd2cb7843e1b -> 92e472f520a5
• google.golang.org/appengine v1.6.7 new
• google.golang.org/grpc v1.37.0 -> v1.38.0
• gopkg.in/ini.v1 v1.62.0 new
• inet.af/netaddr 1d252cf8125e new
• k8s.io/api v0.21.0 -> v0.21.1
• k8s.io/apimachinery v0.21.0 -> v0.21.1
• k8s.io/apiserver v0.21.0 -> v0.21.1
• k8s.io/client-go v0.21.0 -> v0.21.1
• k8s.io/kubectl v0.21.0 -> v0.21.1
• k8s.io/kubelet v0.21.0 -> v0.21.1
• k8s.io/utils 2afb4311ab10 new
• sigs.k8s.io/structured-merge-diff/v4 v4.1.1 new

Previous release can be found at v0.10.0

Images

quay.io/coreos/flannel:v0.13.0
ghcr.io/talos-systems/install-cni:v0.3.0-1-g4fe2706
docker.io/coredns/coredns:1.8.0
gcr.io/etcd-development/etcd:v3.4.15
k8s.gcr.io/kube-apiserver:v1.21.1
k8s.gcr.io/kube-controller-manager:v1.21.1
k8s.gcr.io/kube-scheduler:v1.21.1
k8s.gcr.io/kube-proxy:v1.21.1
ghcr.io/talos-systems/kubelet:v1.21.1
ghcr.io/talos-systems/installer:v0.11.0-alpha.1
k8s.gcr.io/pause:3.2

---

This discussion was created from the release v0.11.0-alpha.1.