v1.12.0 #12469
Replies: 4 comments 15 replies
-
After 5 minutes of waiting I regret, that my system has no IPMI. Looks like something is wrong with the new version, coming from 1.11.4 |
Beta Was this translation helpful? Give feedback.
-
|
if it's arm64 node, you might be hitting kexec issue, but it's not really v1.12.0 (there is a workaround in v1.11.6 for it though). |
Beta Was this translation helpful? Give feedback.
-
|
Its a x86 node running with a Ryzen 5825U / 64GB RAM / 2x nvme for each node in UEFI mode. |
Beta Was this translation helpful? Give feedback.
-
|
@smira after hard reboot the node the system booted in 1.12.0 without any issues. After upgrading the second node to 1.12 it was also stuck and needed a hard reboot and then booted in 1.12.0 without any issues at all. None of the last Talos versions has this issue, so no idea what's going on here :/ |
Beta Was this translation helpful? Give feedback.
-
|
@smira I've tryed again on the third node but this time with the "--reboot-mode "powercycle"" argument and it worked fine. But this argument was not needed in the updates past. Is this kexec related? |
Beta Was this translation helpful? Give feedback.
-
|
Try disabling kexec, generate a new image with |
Beta Was this translation helpful? Give feedback.
-
|
I apologize in advanced if this is a bad question. Is anyone else having issues upgrading to k8s 1.35.0 from 1.34.2 after upgrading to talos 1.12.0? I upgraded my local cluster running on proxmox from 1.11.6 and k8s 1.34.2. If I run talosctl upgrade-k8s then it starts pulling k8s 1.34.1. |
Beta Was this translation helpful? Give feedback.
-
|
I had not upgraded talosctl to today's release. I am now able to upgrade k8s to 1.35.0 after upgrading talosctl. |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
With the changes done to |
Beta Was this translation helpful? Give feedback.
-
|
You don't have to migrate, but you need to drop If you generate new machine config for Talos 1.12 from scratch, it will be already set up this way. |
Beta Was this translation helpful? Give feedback.
-
|
Gotcha, thanks @smira . Maybe this is more for the omni repo then, but how can you drop a key in MachineConfig that's not set via a config patch? Looks like it's there live, however none of my patches set it. |
Beta Was this translation helpful? Give feedback.
-
|
it's part of the default machine configuration, and Omni handles this correctly - as you had your cluster created pre-1.12, it keeps machine configuration backwards compatible to avoid "surprises" on upgrade. If you create new cluster on v1.12.0, Omni will generate new machine config with v1.12 defaults. if you still want to drop, you should use |
Beta Was this translation helpful? Give feedback.
-
|
I'm unable to generate a talos-bundle for 1.12.0 using this talosctl ➜ ~ talosctl images talos-bundle v1.12.0
invalid argument "v1.12.0" for "talosctl image talos-bundle": tag for the bundle must be within range "v1.11.0-alpha.0" - "v1.12.0"
➜ ~ talosctl version
Client:
Tag: v1.12.0
SHA: undefined
Built: 2025-12-22T10:11:18Z
Go version: go1.25.5
OS/Arch: linux/amd64
``` |
Beta Was this translation helpful? Give feedback.
-
|
this should be fixed in 1.12.1, right @shanduur ? |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Talos 1.12.0 (2025-12-22)
Welcome to the v1.12.0 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
What's New
See also What's new in Talos v1.12.0 in the documentation for a summary of the most notable changes in this release.
API Server Cipher Suites
The Kubernetes API server in Talos has been updated to use a more secure set of TLS cipher suites by default.
This is in line with a set of best practices documented in CIS 1.12 benchmark.
You can still expand the list of supported cipher suites via the
cluster.apiServer.extraArgs."tls-cipher-suites"machine configuration field if needed.New User Volume type - bind
New field in UserVolumeConfig -
volumeTypethat defaults topartition, but can be set todirectory.When set to
directory, provisioning and filesystem operations are skipped and a directory is created under/var/mnt/<name>.The
directorytype enables lightweight storage volumes backed by a host directory, instead of requiring a full block device partition.When
volumeType = "directory":/var/mnt/<metadata.name>;provisioning,filesystemandencryptionare prohibited.Note: this mode does not provide filesystem-level isolation and inherits the EPHEMERAL partition capacity limits.
It should not be used for workloads requiring predictable storage quotas.
Disk Encryption
Talos versions prior to v1.12 used the state of PCR 7 and signed policies locked to PCR 11 for TPM based disk encryption.
Talos now supports configuring which PCRs states are to be used for TPM based disk encryption via the
options.pcrsfield in the
tpmsection of the disk encryption configuration.If user doesn't specify any options Talos defaults to using PCR 7 for backwards compatibility with existing installations.
This change was made to improve compatibility with systems that may have varying states in PCR 7 due to UEFI Secure Boot configurations
and users may wish to disable locking to PCR 7 state entirely.
Signed PCR policies will still be bound to PCR 11.
The currently used PCR's can be seen with
talosctl get volumestatus <volume> -o yamlcommand.New User Volume type - disk
volumeTypein UserVolumeConfig can be set todisk.When set to
disk, a full block device is used for the volume.When
volumeType = "disk":minSize,maxSize,grow).Embedded Config
Talos Linux now supports embedding the machine configuration directly into the boot image.
etcd
etcd container image is now pulled from
registry.k8s.io/etcdinstead ofgcr.io/etcd-development/etcd.Ethernet Configuration
The Ethernet configuration now includes a
wakeOnLANfield to enable Wake-on-LAN (WOL) support.This field can be set to enable WOL and specify the desired WOL modes.
Extra Binaries
Talos Linux now ships with
nftbinary in the rootfs to support CNIs which shell out tonftcommand.Feature Lock
Talos now ignores the following machine configuration fields:
machine.features.rbac(locked to true)machine.features.apidCheckExtKeyUsage(locked to true)cluster.apiServer.disablePodSecurityPolicy(locked to true)These fields were removed from the default machine configuration schema in v1.12 and are now always set to the locked values above.
Talos force reboot
Talos now supports a "force" reboot mode, which allows skipping the graceful userland termination.
It can be used in situations where a userland service (e.g. the kubelet) gets stuck during graceful shutdown, causing the regular reboot flow to fail.
In addition,
talosctlwas updated to support this feature viatalosctl reboot --mode force.GRUB
Talos Linux introduces new machine configuration option
.machine.install.grubUseUKICmdlineto control whether GRUB should use the kernel command lineprovided by the boot assets (UKI) or to use the command line constructed by Talos itself (legacy behavior).
This option defaults to
truefor new installations, which means that GRUB will use the command line from the UKI, making it easier to customize kernel parameters via boot asset generation.For existing installations upgrading to v1.12, this option will default to
falseto preserve the legacy behavior.Kernel Log
The kernel log (dmesg) is now also available as the service log named
kernel(talosctl logs kernel).Kernel Module
Talos now supports optionally disabling kernel module signature verification by setting
module.sig_enforce=0kernel parameter.By default module signature verification is enabled (
module.sig_enforce=1).When using Factory or Imager supply as
-module.sig_enfore module.sig_enforce=0kernel parameters to disable module signature enforcement.Kernel Security Posture Profile (KSPP)
Talos now enables a stricter set of KSPP sysctl settings by default.
The list of overridden settings is available with
talosctl get kernelparamstatuscommand.Encrypted Volumes
Talos Linux now consistently provides mapped names for encrypted volumes in the format
/dev/mapper/luks2-<volume-id>.This change should not affect system or user volumes, but might allow easier identification of encrypted volumes,
and specifically for raw encrypted volumes.
Network Configuration
The network configuration under
.machine.network(with the exception of KubeSpan) has been deprecated, but it is still supported for backwards compatibility.See documentation for more information.
Persistent logs
Talos now stores system component logs in /var/log, featuring automatic log rotation and keeping two most
recent log files. This change allows collecting logs from Talos like on any other Linux system.
CRI Registry Configuration
The CRI registry configuration in v1apha1 legacy machine configuration under
.machine.registriesis now deprecated, but still supported for backwards compatibility.New configuration documents
RegistryMirrorConfig,RegistryAuthConfigandRegistryTLSConfigshould be used instead.talosctl image cache-serve
talosctlincludes new subcommandimage cache-serve.It allows serving the created OCI image registry over HTTP/HTTPS.
It is a read-only registry, meaning images cannot be pushed to it, but the backing storage can be updated by re-running the
cache-createcommand;Additionally
talosctl image cache-createhas some changes:--layout:oci(default),flat:ocipreserves current behavior;flatdoes not repack artifact layer, but moves it to a destination directory, allowing it to be served bytalosctl image cache-serve;--platform: now can accept multiple os/arch combinations:--platform=linux/amd64,linux/arm64);--platform=linux/amd64 --platform=linux/arm64);UEFI Boot
When using UEFI boot with systemd-boot as bootloader (on new installs of Talos from 1.10+ onwards), Talos will now not touch the UEFI boot order.
Talos 1.11 made a fix to create UEFI boot entry and set the boot order as first entry, but this behavior caused issues on some systems.
To avoid further issues, Talos will now only create the UEFI boot entry if it does not exist, but will not modify the boot order.
Component Updates
Linux: 6.18.1
Kubernetes: 1.35.0
CNI Plugins: 1.9.0
cryptsetup: 2.8.1
LVM2: 2_03_37
systemd-udevd: 257.8
etcd: 3.6.7
CoreDNS: 1.13.2
Flannel: 0.27.4
Flannel CNI plugin: v1.8.0-flannel2
runc: 1.3.4
containerd: 2.1.6
zfs: 2.4.0
Talos is built with Go 1.25.5.
Contributors
Changes
360 commits
nftbinarytalosctl logs kernelclient.ErrEventNotSupportedlatesttag only on mainconstants.MinimumGOAMD64Levelusing build tag.gittext/templateinmachinedcode pathstalos.config.earlycommand line argChanges since v1.12.0-rc.1
14 commits
nftbinaryChanges from siderolabs/crypto
2 commits
Changes from siderolabs/gen
1 commit
Changes from siderolabs/go-api-signature
5 commits
invalid signatureerror when a signature is requiredChanges from siderolabs/go-debug
2 commits
Changes from siderolabs/go-kubernetes
3 commits
Changes from siderolabs/go-loadbalancer
1 commit
Changes from siderolabs/go-talos-support
2 commits
Changes from siderolabs/pkgs
78 commits
Changes from siderolabs/tools
22 commits
Dependency Changes
Previous release can be found at v1.11.0
Images
This discussion was created from the release v1.12.0.
Beta Was this translation helpful? Give feedback.
All reactions