Skip to content

Commit bb62b29

Browse files
shanduurshanduur
committed
chore: prepare talos for 1.13
Add compatibility with 1.13 and fix/upgrade tests. Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>
1 parent c093503 commit bb62b29

File tree

15 files changed

+471
-212
lines changed

15 files changed

+471
-212
lines changed

‎Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1288,10 +1288,10 @@ FROM scratch AS proto-docs-build
12881288
COPY --from=generate-build-clean /api/docs/api.md /api.md
12891289

12901290
FROM scratch AS docs
1291-
COPY --from=docs-build /tmp/configuration/ /website/content/v1.12/reference/configuration/
1292-
COPY --from=docs-build /tmp/cli.md /website/content/v1.12/reference/
1293-
COPY --from=docs-build /tmp/schemas /website/content/v1.12/schemas/
1294-
COPY --from=proto-docs-build /api.md /website/content/v1.12/reference/
1291+
COPY --from=docs-build /tmp/configuration/ /website/content/v1.13/reference/configuration/
1292+
COPY --from=docs-build /tmp/cli.md /website/content/v1.13/reference/
1293+
COPY --from=docs-build /tmp/schemas /website/content/v1.13/schemas/
1294+
COPY --from=proto-docs-build /api.md /website/content/v1.13/reference/
12951295

12961296
# The talosctl-cni-bundle builds the CNI bundle for talosctl.
12971297

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ See [Contributing](CONTRIBUTING.md) for our guidelines.
5757
## License
5858

5959
<a href="https://github.com/siderolabs/talos/blob/master/LICENSE">
60-
<img alt="GitHub" src="https://img.shields.io/github/license/siderolabs/talos?style=flat-square">
60+
<img alt="GitHub" src="https://img.shields.io/github/license/siderolabs/talos">
6161
</a>
6262

6363
Some software we distribute is under the General Public License family of licenses or other licenses that require we provide you with the source code.

‎hack/release.toml‎

Lines changed: 1 addition & 198 deletions
Original file line numberDiff line numberDiff line change
@@ -18,206 +18,9 @@ preface = """
1818
[notes.updates]
1919
title = "Component Updates"
2020
description = """\
21-
Linux: 6.18.0
22-
Kubernetes: 1.35.0-rc.1
23-
CNI Plugins: 1.9.0
24-
cryptsetup: 2.8.1
25-
LVM2: 2_03_37
26-
systemd-udevd: 257.8
27-
runc: 1.3.4
28-
CoreDNS: 1.13.1
29-
etcd: 3.6.6
30-
Flannel: 0.27.4
31-
Flannel CNI plugin: v1.8.0-flannel2
32-
containerd: 2.1.5
33-
34-
> For Talos 1.13 only:
35-
> containerd: 2.2.0
21+
containerd: 2.2.0
3622
3723
Talos is built with Go 1.25.5.
38-
"""
39-
40-
[notes.luks2]
41-
title = "Encrypted Volumes"
42-
description = """\
43-
Talos Linux now consistently provides mapped names for encrypted volumes in the format `/dev/mapper/luks2-<volume-id>`.
44-
This change should not affect system or user volumes, but might allow easier identification of encrypted volumes,
45-
and specifically for raw encrypted volumes.
46-
"""
47-
48-
[notes.disk-encryption]
49-
title = "Disk Encryption"
50-
description = """\
51-
Talos versions prior to v1.12 used the state of PCR 7 and signed policies locked to PCR 11 for TPM based disk encryption.
52-
53-
Talos now supports configuring which PCRs states are to be used for TPM based disk encryption via the `options.pcrs`
54-
field in the `tpm` section of the disk encryption configuration.
55-
56-
If user doesn't specify any options Talos defaults to using PCR 7 for backwards compatibility with existing installations.
57-
58-
This change was made to improve compatibility with systems that may have varying states in PCR 7 due to UEFI Secure Boot configurations
59-
and users may wish to disable locking to PCR 7 state entirely.
60-
61-
Signed PCR policies will still be bound to PCR 11.
62-
63-
The currently used PCR's can be seen with `talosctl get volumestatus <volume> -o yaml` command.
64-
"""
65-
66-
[notes.kspp]
67-
title = "Kernel Security Posture Profile (KSPP)"
68-
description = """\
69-
Talos now enables a stricter set of KSPP sysctl settings by default.
70-
The list of overridden settings is available with `talosctl get kernelparamstatus` command.
71-
"""
72-
73-
[notes.extra-binaries]
74-
title = "Extra Binaries"
75-
description = """\
76-
Talos Linux now ships with `nft` binary in the rootfs to support CNIs which shell out to `nft` command.
77-
"""
78-
79-
[notes.ethernet-config]
80-
title = "Ethernet Configuration"
81-
description = """\
82-
The Ethernet configuration now includes a `wakeOnLAN` field to enable Wake-on-LAN (WOL) support.
83-
This field can be set to enable WOL and specify the desired WOL modes.
84-
"""
85-
86-
[notes.embedded-config]
87-
title = "Embedded Config"
88-
description = """\
89-
Talos Linux now supports [embedding the machine configuration](https://www.talos.dev/v1.12/talos-guides/configuration/acquire/) directly into the boot image.
90-
"""
91-
92-
[notes.feature-lock]
93-
title = "Feature Lock"
94-
description = """\
95-
Talos now ignores the following machine configuration fields:
96-
97-
- `machine.features.rbac` (locked to true)
98-
- `machine.features.apidCheckExtKeyUsage` (locked to true)
99-
- `cluster.apiServer.disablePodSecurityPolicy` (locked to true)
100-
101-
These fields were removed from the default machine configuration schema in v1.12 and are now always set to the locked values above.
102-
"""
103-
104-
[notes.etcd]
105-
title = "etcd"
106-
description = """\
107-
etcd container image is now pulled from `registry.k8s.io/etcd` instead of `gcr.io/etcd-development/etcd`.
108-
"""
109-
110-
[notes.talosctl]
111-
title = "talosctl image cache-serve"
112-
description = """\
113-
`talosctl` includes new subcommand `image cache-serve`.
114-
It allows serving the created OCI image registry over HTTP/HTTPS.
115-
It is a read-only registry, meaning images cannot be pushed to it, but the backing storage can be updated by re-running the `cache-create` command;
116-
117-
Additionally `talosctl image cache-create` has some changes:
118-
* new flag `--layout`: `oci` (_default_), `flat`:
119-
* `oci` preserves current behavior;
120-
* `flat` does not repack artifact layer, but moves it to a destination directory, allowing it to be served by `talosctl image cache-serve`;
121-
* changed flag `--platform`: now can accept multiple os/arch combinations:
122-
* comma separated (`--platform=linux/amd64,linux/arm64`);
123-
* multiple instances (`--platform=linux/amd64 --platform=linux/arm64`);
124-
"""
125-
126-
[notes.force-reboot]
127-
title = "Talos force reboot"
128-
description = """\
129-
Talos now supports a "force" reboot mode, which allows skipping the graceful userland termination.
130-
It can be used in situations where a userland service (e.g. the kubelet) gets stuck during graceful shutdown, causing the regular reboot flow to fail.
131-
132-
In addition, `talosctl` was updated to support this feature via `talosctl reboot --mode force`.
133-
"""
134-
135-
[notes.kernel-module]
136-
title = "Kernel Module"
137-
description = """\
138-
Talos now supports optionally disabling kernel module signature verification by setting `module.sig_enforce=0` kernel parameter.
139-
By default module signature verification is enabled (`module.sig_enforce=1`).
140-
When using Factory or Imager supply as `-module.sig_enfore module.sig_enforce=0` kernel parameters to disable module signature enforcement.
141-
"""
142-
143-
[notes.grub]
144-
title = "GRUB"
145-
description = """\
146-
Talos Linux introduces new machine configuration option `.machine.install.grubUseUKICmdline` to control whether GRUB should use the kernel command line
147-
provided by the boot assets (UKI) or to use the command line constructed by Talos itself (legacy behavior).
148-
149-
This option defaults to `true` for new installations, which means that GRUB will use the command line from the UKI, making it easier to customize kernel parameters via boot asset generation.
150-
For existing installations upgrading to v1.12, this option will default to `false` to preserve the legacy behavior.
151-
"""
152-
153-
[notes.directory-user-volumes]
154-
title = "New User Volume type - bind"
155-
description = """\
156-
New field in UserVolumeConfig - `volumeType` that defaults to `partition`, but can be set to `directory`.
157-
When set to `directory`, provisioning and filesystem operations are skipped and a directory is created under `/var/mnt/<name>`.
158-
159-
The `directory` type enables lightweight storage volumes backed by a host directory, instead of requiring a full block device partition.
160-
161-
When `volumeType = "directory"`:
162-
- A directory is created at `/var/mnt/<metadata.name>`;
163-
- `provisioning`, `filesystem` and `encryption` are prohibited.
164-
165-
Note: this mode does not provide filesystem-level isolation and inherits the EPHEMERAL partition capacity limits.
166-
It should not be used for workloads requiring predictable storage quotas.
167-
"""
168-
169-
[notes.registry-configuration]
170-
title = "CRI Registry Configuration"
171-
description = """\
172-
The CRI registry configuration in v1apha1 legacy machine configuration under `.machine.registries` is now deprecated, but still supported for backwards compatibility.
173-
New configuration documents `RegistryMirrorConfig`, `RegistryAuthConfig` and `RegistryTLSConfig` should be used instead.
174-
"""
175-
176-
[notes.disk-user-volumes]
177-
title = "New User Volume type - disk"
178-
description = """\
179-
`volumeType` in UserVolumeConfig can be set to `disk`.
180-
When set to `disk`, a full block device is used for the volume.
181-
182-
When `volumeType = "disk"`:
183-
- Size specific settings are not allowed in the provisioning block (`minSize`, `maxSize`, `grow`).
184-
"""
185-
186-
[notes.uefi-boot]
187-
title = "UEFI Boot"
188-
description = """\
189-
When using UEFI boot with systemd-boot as bootloader (on new installs of Talos from 1.10+ onwards), Talos will now not touch the UEFI boot order.
190-
Talos 1.11 made a fix to create UEFI boot entry and set the boot order as first entry, but this behavior caused issues on some systems.
191-
To avoid further issues, Talos will now only create the UEFI boot entry if it does not exist, but will not modify the boot order.
192-
"""
193-
194-
[notes.network-configuration]
195-
title = "Network Configuration"
196-
description = """\
197-
The network configuration under `.machine.network` (with the exception of KubeSpan) has been deprecated, but it is still supported for backwards compatibility.
198-
See [documentation](https://docs.siderolabs.com/talos/v1.12/networking/configuration/overview) for more information.
199-
"""
200-
201-
[notes.apiserver-cipher-suites]
202-
title = "API Server Cipher Suites"
203-
description = """\
204-
The Kubernetes API server in Talos has been updated to use a more secure set of TLS cipher suites by default.
205-
This is in line with a set of best practices documented in CIS 1.12 benchmark.
206-
207-
You can still expand the list of supported cipher suites via the `cluster.apiServer.extraArgs."tls-cipher-suites"` machine configuration field if needed.
208-
"""
209-
210-
[notes.kernel-log]
211-
title = "Kernel Log"
212-
description = """\
213-
The kernel log (dmesg) is now also available as the service log named `kernel` (`talosctl logs kernel`).
214-
"""
215-
216-
[notes.persistent-logs]
217-
title = "Persistent logs"
218-
description = """\
219-
Talos now stores system component logs in /var/log, featuring automatic log rotation and keeping two most
220-
recent log files. This change allows collecting logs from Talos like on any other Linux system.
22124
"""
22225

22326
[make_deps]

‎pkg/machinery/compatibility/kubernetes_version.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos110"
1414
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos111"
1515
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos112"
16+
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos113"
1617
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos12"
1718
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos13"
1819
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos14"
@@ -73,6 +74,8 @@ func (v *KubernetesVersion) SupportedWith(target *TalosVersion) error {
7374
minK8sVersion, maxK8sVersion = talos111.MinimumKubernetesVersion, talos111.MaximumKubernetesVersion
7475
case talos112.MajorMinor: // upgrades to 1.12.x
7576
minK8sVersion, maxK8sVersion = talos112.MinimumKubernetesVersion, talos112.MaximumKubernetesVersion
77+
case talos113.MajorMinor: // upgrades to 1.13.x
78+
minK8sVersion, maxK8sVersion = talos113.MinimumKubernetesVersion, talos113.MaximumKubernetesVersion
7679
default:
7780
return fmt.Errorf("compatibility with version %s is not supported", target.String())
7881
}

‎pkg/machinery/compatibility/kubernetes_version_test.go‎

Lines changed: 35 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -385,12 +385,45 @@ func TestKubernetesCompatibility112(t *testing.T) {
385385
}
386386
}
387387

388+
func TestKubernetesCompatibility113(t *testing.T) {
389+
for _, tt := range []kubernetesVersionTest{
390+
{
391+
kubernetesVersion: "1.31.1",
392+
target: "1.13.0",
393+
},
394+
{
395+
kubernetesVersion: "1.32.1",
396+
target: "1.13.0",
397+
},
398+
{
399+
kubernetesVersion: "1.35.3",
400+
target: "1.13.0-beta.0",
401+
},
402+
{
403+
kubernetesVersion: "1.36.0-rc.0",
404+
target: "1.13.7",
405+
},
406+
{
407+
kubernetesVersion: "1.37.0-alpha.0",
408+
target: "1.13.0",
409+
expectedError: "version of Kubernetes 1.37.0-alpha.0 is too new to be used with Talos 1.13.0",
410+
},
411+
{
412+
kubernetesVersion: "1.30.1",
413+
target: "1.13.0",
414+
expectedError: "version of Kubernetes 1.30.1 is too old to be used with Talos 1.13.0",
415+
},
416+
} {
417+
runKubernetesVersionTest(t, tt)
418+
}
419+
}
420+
388421
func TestKubernetesCompatibilityUnsupported(t *testing.T) {
389422
for _, tt := range []kubernetesVersionTest{
390423
{
391424
kubernetesVersion: "1.25.0",
392-
target: "1.13.0-alpha.0",
393-
expectedError: "compatibility with version 1.13.0-alpha.0 is not supported",
425+
target: "1.14.0-alpha.0",
426+
expectedError: "compatibility with version 1.14.0-alpha.0 is not supported",
394427
},
395428
{
396429
kubernetesVersion: "1.25.0",

‎pkg/machinery/compatibility/talos112/talos112.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99
"github.com/blang/semver/v4"
1010
)
1111

12-
// MajorMinor is the major.minor version of Talos 1.11.
12+
// MajorMinor is the major.minor version of Talos 1.12.
1313
var MajorMinor = [2]uint64{1, 12}
1414

1515
// MinimumHostUpgradeVersion is the minimum version of Talos that can be upgraded to 1.12.

‎pkg/machinery/compatibility/talos113/talos113.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// This Source Code Form is subject to the terms of the Mozilla Public
2+
// License, v. 2.0. If a copy of the MPL was not distributed with this
3+
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
4+
5+
// Package talos113 provides compatibility constants for Talos 1.13.
6+
package talos113
7+
8+
import (
9+
"github.com/blang/semver/v4"
10+
)
11+
12+
// MajorMinor is the major.minor version of Talos 1.13.
13+
var MajorMinor = [2]uint64{1, 13}
14+
15+
// MinimumHostUpgradeVersion is the minimum version of Talos that can be upgraded to 1.13.
16+
var MinimumHostUpgradeVersion = semver.MustParse("1.11.0")
17+
18+
// MaximumHostDowngradeVersion is the maximum (not inclusive) version of Talos that can be downgraded to 1.13.
19+
var MaximumHostDowngradeVersion = semver.MustParse("1.15.0")
20+
21+
// DeniedHostUpgradeVersions are the versions of Talos that cannot be upgraded to 1.13.
22+
var DeniedHostUpgradeVersions []semver.Version
23+
24+
// MinimumKubernetesVersion is the minimum version of Kubernetes is supported with 1.13.
25+
var MinimumKubernetesVersion = semver.MustParse("1.31.0")
26+
27+
// MaximumKubernetesVersion is the maximum version of Kubernetes is supported with 1.13.
28+
var MaximumKubernetesVersion = semver.MustParse("1.36.99")

‎pkg/machinery/compatibility/talos_version.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos110"
1616
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos111"
1717
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos112"
18+
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos113"
1819
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos12"
1920
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos13"
2021
"github.com/siderolabs/talos/pkg/machinery/compatibility/talos14"
@@ -111,6 +112,9 @@ func (v *TalosVersion) UpgradeableFrom(host *TalosVersion) error {
111112
case talos112.MajorMinor: // upgrades to 1.12.x
112113
minHostUpgradeVersion, maxHostDowngradeVersion = talos112.MinimumHostUpgradeVersion, talos112.MaximumHostDowngradeVersion
113114
deniedHostUpgradeVersions = talos112.DeniedHostUpgradeVersions
115+
case talos113.MajorMinor: // upgrades to 1.13.x
116+
minHostUpgradeVersion, maxHostDowngradeVersion = talos113.MinimumHostUpgradeVersion, talos113.MaximumHostDowngradeVersion
117+
deniedHostUpgradeVersions = talos113.DeniedHostUpgradeVersions
114118
default:
115119
return fmt.Errorf("upgrades to version %s are not supported", v.version.String())
116120
}

0 commit comments

Comments
 (0)