diff --git a/.github/scripts/setup-talosctl.sh b/.github/scripts/setup-talosctl.sh index b78b0f0558..b2fcd7c147 100755 --- a/.github/scripts/setup-talosctl.sh +++ b/.github/scripts/setup-talosctl.sh @@ -20,10 +20,10 @@ set -euo pipefail # inspects a single node, which reads as a fleet-wide fault rather than a stale # pin. # renovate: datasource=github-releases depName=siderolabs/talos extractVersion=^v(?.+)$ -TALOS_VERSION="1.13.11" +TALOS_VERSION="1.14.4" # SHA-256 of talosctl-linux-amd64 for the TALOS_VERSION above, from that # release's sha256sum.txt. UPDATE BOTH TOGETHER. -TALOSCTL_SHA256="d4358faf5ebd740ab92ec4a9e3111f2f271f681e479f07b8603a3616c76b2413" +TALOSCTL_SHA256="0a69e3f9b682c5cd844b78dae305f6056ceb86c5fcc6913dcea78c527ed97cee" asset_name="talosctl-linux-amd64" release_base="https://github.com/siderolabs/talos/releases/download/v${TALOS_VERSION}" diff --git a/ksail.prod.yaml b/ksail.prod.yaml index 21888c500c..3718846a11 100644 --- a/ksail.prod.yaml +++ b/ksail.prod.yaml @@ -174,7 +174,7 @@ spec: # Roll the already-declared audit/AppArmor Image Factory schematic onto # static nodes. Machine-config sync alone cannot replace baked-in kernel # arguments when the running OS version remains unchanged (#4098). - version: v1.13.11 + version: v1.14.4 # Hetzner Talos ISO (x86_64). The v1.11.2 ISO (122630) was deprecated # and removed from Hetzner on 2026-03-18. Use v1.12.4 (125127). iso: 125127 diff --git a/scripts/pdb-selector-exceptions.tsv b/scripts/pdb-selector-exceptions.tsv index c2542b966b..6a913f883a 100644 --- a/scripts/pdb-selector-exceptions.tsv +++ b/scripts/pdb-selector-exceptions.tsv @@ -34,5 +34,5 @@ # selector and when its producer does not hold. A row for a budget that a rendered workload # satisfies, that its cluster does not render, or for a cluster that is no overlay, fails the # guard, so remove it then. -prod kube-system/coredns external:talos file:ksail.prod.yaml:.spec.cluster.talos.version v1.13.11 - Talos installs the CoreDNS Deployment from its own bootstrap manifests, so no layer of the prod cluster renders it. Pod label k8s-app=kube-dns verified in the Talos source, internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/coredns.go. +prod kube-system/coredns external:talos file:ksail.prod.yaml:.spec.cluster.talos.version v1.14.4 - Talos installs the CoreDNS Deployment from its own bootstrap manifests, so no layer of the prod cluster renders it. Pod label k8s-app=kube-dns verified in the Talos source, internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/coredns.go. prod observability/coroot-coroot Coroot/observability/coroot HelmRelease/observability/coroot-operator 0.10.6 Deployment/crossplane-sync-exporter coroot-operator builds the coroot-coroot StatefulSet from this custom resource at runtime; its chart renders only the operator. Pod labels managed-by=coroot-operator, part-of= and component=coroot verified in the coroot-operator source (app version v1.10.6), controller/controller.go Labels and controller/coroot.go. The crossplane-sync-exporter Deployment is this repository's own metrics exporter; it shares only the grouping label part-of=coroot. diff --git a/scripts/tests/test-talos-apparmor-lsm.sh b/scripts/tests/test-talos-apparmor-lsm.sh index 979f8ef9c5..b1de4509fa 100755 --- a/scripts/tests/test-talos-apparmor-lsm.sh +++ b/scripts/tests/test-talos-apparmor-lsm.sh @@ -6,10 +6,10 @@ config=${1:-"$root_dir/talos/cluster/enable-apparmor.yaml"} schematic=${2:-"$root_dir/talos/factory-schematic.yaml"} cluster_config="$root_dir/ksail.prod.yaml" ci_workflow="$root_dir/.github/workflows/ci.yaml" -expected_talos_version='v1.13.11' -# v1.13.11 pins pkgs 642a01b; kernel/build/config-amd64 retains the same -# CONFIG_LSM inventory. Preserve that list while testing the required order. -expected_modules='apparmor,bpf,integrity,landlock,loadpin,lockdown,safesetid,selinux,yama' +expected_talos_version='v1.14.4' +# v1.14.4 pins pkgs 2ec10eb; its kernel/build/config-amd64 CONFIG_LSM drops loadpin +# (CONFIG_SECURITY_LOADPIN is unset). Preserve that list while testing the required order. +expected_modules='apparmor,bpf,integrity,landlock,lockdown,safesetid,selinux,yama' if ! grep -Fq "'scripts/tests/test-talos-apparmor-lsm.sh'" "$ci_workflow" || ! grep -Fq "'scripts/tests/test-talos-apparmor-lsm-regressions.sh'" "$ci_workflow" || diff --git a/scripts/validate-talos-kubernetes-compatibility/main_test.go b/scripts/validate-talos-kubernetes-compatibility/main_test.go index 5ba23b8074..ca08306bb0 100644 --- a/scripts/validate-talos-kubernetes-compatibility/main_test.go +++ b/scripts/validate-talos-kubernetes-compatibility/main_test.go @@ -21,6 +21,8 @@ func fixture(t *testing.T, body string) string { func TestVersionPairings(t *testing.T) { for _, tc := range []struct{ name, talos, kubernetes, diagnostic string }{ {"current production", "v1.13.11", "v1.36.4", ""}, + {"proposed Talos upgrade", "v1.14.4", "v1.36.4", ""}, + {"Kubernetes 1.37 after the Talos upgrade", "v1.14.4", "v1.37.1", ""}, {"in-range patch bump", "v1.13.9", "v1.36.5", ""}, {"rejected PR 3534", "v1.13.9", "v1.37.0", "too new"}, {"too old", "v1.13.9", "v1.30.0", "too old"}, diff --git a/talos/cluster/enable-apparmor.yaml b/talos/cluster/enable-apparmor.yaml index 8cca440b2a..e514fbb13b 100644 --- a/talos/cluster/enable-apparmor.yaml +++ b/talos/cluster/enable-apparmor.yaml @@ -1,14 +1,14 @@ machine: install: extraKernelArgs: - # Keep Talos v1.13.11's CONFIG_LSM list, but select AppArmor before + # Keep Talos v1.14.4's CONFIG_LSM list, but select AppArmor before # SELinux: these major LSMs are exclusive, so only the first activates. # AppArmor must also precede BPF, whose audit-context hook otherwise # takes precedence and causes "audit: error in audit_log_subj_ctx". # See Linux security/security.c and CachyOS/linux-cachyos#878. # apparmor=1 enables AppArmor explicitly rather than relying on the kernel default. - apparmor=1 - - lsm=yama,apparmor,selinux,loadpin,safesetid,integrity,bpf,lockdown,landlock + - lsm=yama,apparmor,selinux,safesetid,integrity,bpf,lockdown,landlock # KSail folds this native Talos declaration into the Image Factory # schematic, clears the deprecated rendered extraKernelArgs field, and pins # grubUseUKICmdline=true so the baked-in arguments take effect. The canonical diff --git a/talos/factory-schematic.yaml b/talos/factory-schematic.yaml index 6eeb157582..db1ea0b06b 100644 --- a/talos/factory-schematic.yaml +++ b/talos/factory-schematic.yaml @@ -1,7 +1,7 @@ customization: extraKernelArgs: - apparmor=1 - - lsm=yama,apparmor,selinux,loadpin,safesetid,integrity,bpf,lockdown,landlock + - lsm=yama,apparmor,selinux,safesetid,integrity,bpf,lockdown,landlock systemExtensions: officialExtensions: - siderolabs/iscsi-tools