chore(deps): update dependency siderolabs/talos to v1.14.4

.github/scripts/setup-talosctl.sh

@@ -20,10 +20,10 @@ set -euo pipefail
 # inspects a single node, which reads as a fleet-wide fault rather than a stale
 # pin.
 # renovate: datasource=github-releases depName=siderolabs/talos extractVersion=^v(?<version>.+)$
-TALOS_VERSION="1.13.11"
+TALOS_VERSION="1.14.4"
 # SHA-256 of talosctl-linux-amd64 for the TALOS_VERSION above, from that
 # release's sha256sum.txt. UPDATE BOTH TOGETHER.
-TALOSCTL_SHA256="d4358faf5ebd740ab92ec4a9e3111f2f271f681e479f07b8603a3616c76b2413"
+TALOSCTL_SHA256="0a69e3f9b682c5cd844b78dae305f6056ceb86c5fcc6913dcea78c527ed97cee"
 
 asset_name="talosctl-linux-amd64"
 release_base="https://github.com/siderolabs/talos/releases/download/v${TALOS_VERSION}"

ksail.prod.yaml

@@ -174,7 +174,7 @@ spec:
       # Roll the already-declared audit/AppArmor Image Factory schematic onto
       # static nodes. Machine-config sync alone cannot replace baked-in kernel
       # arguments when the running OS version remains unchanged (#4098).
-      version: v1.13.11
+      version: v1.14.4
       # Hetzner Talos ISO (x86_64). The v1.11.2 ISO (122630) was deprecated
       # and removed from Hetzner on 2026-03-18. Use v1.12.4 (125127).
       iso: 125127

scripts/pdb-selector-exceptions.tsv

@@ -34,5 +34,5 @@
 # selector and when its producer does not hold. A row for a budget that a rendered workload
 # satisfies, that its cluster does not render, or for a cluster that is no overlay, fails the
 # guard, so remove it then.
-prod	kube-system/coredns	external:talos	file:ksail.prod.yaml:.spec.cluster.talos.version	v1.13.11	-	Talos installs the CoreDNS Deployment from its own bootstrap manifests, so no layer of the prod cluster renders it. Pod label k8s-app=kube-dns verified in the Talos source, internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/coredns.go.
+prod	kube-system/coredns	external:talos	file:ksail.prod.yaml:.spec.cluster.talos.version	v1.14.4	-	Talos installs the CoreDNS Deployment from its own bootstrap manifests, so no layer of the prod cluster renders it. Pod label k8s-app=kube-dns verified in the Talos source, internal/app/machined/pkg/controllers/k8s/internal/k8stemplates/coredns.go.
 prod	observability/coroot-coroot	Coroot/observability/coroot	HelmRelease/observability/coroot-operator	0.10.6	Deployment/crossplane-sync-exporter	coroot-operator builds the coroot-coroot StatefulSet from this custom resource at runtime; its chart renders only the operator. Pod labels managed-by=coroot-operator, part-of=<resource name> and component=coroot verified in the coroot-operator source (app version v1.10.6), controller/controller.go Labels and controller/coroot.go. The crossplane-sync-exporter Deployment is this repository's own metrics exporter; it shares only the grouping label part-of=coroot.

scripts/tests/test-talos-apparmor-lsm.sh

@@ -6,10 +6,10 @@ config=${1:-"$root_dir/talos/cluster/enable-apparmor.yaml"}
 schematic=${2:-"$root_dir/talos/factory-schematic.yaml"}
 cluster_config="$root_dir/ksail.prod.yaml"
 ci_workflow="$root_dir/.github/workflows/ci.yaml"
-expected_talos_version='v1.13.11'
-# v1.13.11 pins pkgs 642a01b; kernel/build/config-amd64 retains the same
-# CONFIG_LSM inventory. Preserve that list while testing the required order.
-expected_modules='apparmor,bpf,integrity,landlock,loadpin,lockdown,safesetid,selinux,yama'
+expected_talos_version='v1.14.4'
+# v1.14.4 pins pkgs 2ec10eb; its kernel/build/config-amd64 CONFIG_LSM drops loadpin
+# (CONFIG_SECURITY_LOADPIN is unset). Preserve that list while testing the required order.
+expected_modules='apparmor,bpf,integrity,landlock,lockdown,safesetid,selinux,yama'
 
 if ! grep -Fq "'scripts/tests/test-talos-apparmor-lsm.sh'" "$ci_workflow" ||
   ! grep -Fq "'scripts/tests/test-talos-apparmor-lsm-regressions.sh'" "$ci_workflow" ||

scripts/validate-talos-kubernetes-compatibility/main_test.go

@@ -21,6 +21,8 @@ func fixture(t *testing.T, body string) string {
 func TestVersionPairings(t *testing.T) {
 	for _, tc := range []struct{ name, talos, kubernetes, diagnostic string }{
 		{"current production", "v1.13.11", "v1.36.4", ""},
+		{"proposed Talos upgrade", "v1.14.4", "v1.36.4", ""},
+		{"Kubernetes 1.37 after the Talos upgrade", "v1.14.4", "v1.37.1", ""},
 		{"in-range patch bump", "v1.13.9", "v1.36.5", ""},
 		{"rejected PR 3534", "v1.13.9", "v1.37.0", "too new"},
 		{"too old", "v1.13.9", "v1.30.0", "too old"},

talos/cluster/enable-apparmor.yaml

@@ -1,14 +1,14 @@
 machine:
   install:
     extraKernelArgs:
-      # Keep Talos v1.13.11's CONFIG_LSM list, but select AppArmor before
+      # Keep Talos v1.14.4's CONFIG_LSM list, but select AppArmor before
       # SELinux: these major LSMs are exclusive, so only the first activates.
       # AppArmor must also precede BPF, whose audit-context hook otherwise
       # takes precedence and causes "audit: error in audit_log_subj_ctx".
       # See Linux security/security.c and CachyOS/linux-cachyos#878.
       # apparmor=1 enables AppArmor explicitly rather than relying on the kernel default.
       - apparmor=1
-      - lsm=yama,apparmor,selinux,loadpin,safesetid,integrity,bpf,lockdown,landlock
+      - lsm=yama,apparmor,selinux,safesetid,integrity,bpf,lockdown,landlock
     # KSail folds this native Talos declaration into the Image Factory
     # schematic, clears the deprecated rendered extraKernelArgs field, and pins
     # grubUseUKICmdline=true so the baked-in arguments take effect. The canonical

talos/factory-schematic.yaml

@@ -1,7 +1,7 @@
 customization:
     extraKernelArgs:
         - apparmor=1
-        - lsm=yama,apparmor,selinux,loadpin,safesetid,integrity,bpf,lockdown,landlock
+        - lsm=yama,apparmor,selinux,safesetid,integrity,bpf,lockdown,landlock
     systemExtensions:
         officialExtensions:
             - siderolabs/iscsi-tools