feat(talos)!: update to Talos 1.14 and topf 0.6.0

.github/workflows/template-e2e-cluster.yaml

@@ -63,7 +63,7 @@ jobs:
 
       - name: Boot maintenance-mode nodes
         id: cluster
-        uses: home-operations/talosctl-cluster-action@42a2d1c476f87245e2d1882ec825fb31368b9686 # v0.1.6
+        uses: home-operations/talosctl-cluster-action@fb6a31bf5de43218acc80d2e23958a16eee7380c # v0.2.2
         with:
           config: ./.github/template-tests/e2e/talos-cluster.yaml
           cache: true

.mise/config.toml

@@ -6,7 +6,7 @@ TALOSCONFIG = "{{config_root}}/talos/talosconfig"
 JUST_UNSTABLE = "1"
 
 [tools]
-uv = "0.12.6"                       # required:template
+uv = "0.12.6"                        # required:template
 age = "1.3.1"
 cloudflared = "2026.8.2"
 flux2 = "2.9.4"
@@ -22,10 +22,10 @@ kustomize = "5.8.1"
 lefthook = "2.1.11"
 node = "24.20.0"
 oxfmt = "0.65.0"
-sd = "1.1.0"                        # required:template
+sd = "1.1.0"                         # required:template
 sops = "3.13.3"
-talosctl = "1.13.9"
-"github:postfinance/topf" = "v0.5.0"
+talosctl = "1.14.0"
+"github:postfinance/topf" = "v0.6.0"
 yq = "4.53.6"
 zizmor = "1.29.0"
 

.renovaterc.json5

@@ -24,7 +24,7 @@
     {
       description: "Talos Group",
       groupName: "talos",
-      matchPackageNames: ["ghcr.io/siderolabs/installer", "siderolabs/talos"],
+      matchPackageNames: ["siderolabs/talos"],
       group: {
         commitMessageTopic: "{{{groupName}}} group",
       },

template/config/talos/all/00-install.yaml.tpl.j2

@@ -1,8 +1,9 @@
-machine:
-  install:
+apiVersion: v1alpha1
+kind: UnattendedInstallConfig
+provisioning:
+  diskSelector:
     {{- if .Node.Data.installDisk }}
-    disk: "{{ .Node.Data.installDisk }}"
+    match: disk.dev_path == "{{ .Node.Data.installDisk }}" || "{{ .Node.Data.installDisk }}" in disk.symlinks
     {{- else }}
-    diskSelector:
-      serial: "{{ .Node.Data.installDiskSerial }}"
+    match: disk.serial == "{{ .Node.Data.installDiskSerial }}"
     {{- end }}

template/config/talos/all/10-cluster.yaml.j2

@@ -1,12 +1,10 @@
-# Disable built-in CNI to use Cilium
-cluster:
-  network:
-    cni:
-      name: none
-    podSubnets: ["#{ kubernetes.pod_cidr }#"]
-    serviceSubnets: ["#{ kubernetes.svc_cidr }#"]
 machine:
   certSANs:
     #% for item in cert_sans %#
     - "#{ item }#"
     #% endfor %#
+---
+apiVersion: v1alpha1
+kind: KubeNetworkConfig
+podSubnets: ["#{ kubernetes.pod_cidr }#"]
+serviceSubnets: ["#{ kubernetes.svc_cidr }#"]

template/config/talos/all/21-network.yaml.j2

@@ -1,7 +1,8 @@
-machine:
-  network:
-    disableSearchDomain: true
-    nameservers:
-      #% for item in network.dns_servers %#
-      - #{ item }#
-      #% endfor %#
+apiVersion: v1alpha1
+kind: ResolverConfig
+nameservers:
+  #% for item in network.dns_servers %#
+  - address: #{ item }#
+  #% endfor %#
+searchDomains:
+  disableDefault: true

template/config/talos/all/22-time.yaml.j2

@@ -1,7 +1,7 @@
-machine:
-  time:
-    disabled: false
-    servers:
-      #% for item in network.ntp_servers %#
-      - #{ item }#
-      #% endfor %#
+apiVersion: v1alpha1
+kind: TimeSyncConfig
+ntp:
+  servers:
+    #% for item in network.ntp_servers %#
+    - #{ item }#
+    #% endfor %#

template/config/talos/all/30-kubelet.yaml.j2

@@ -1,13 +1,16 @@
-machine:
-  kubelet:
-    extraConfig:
-      crashLoopBackOff:
-        maxContainerRestartPeriod: 60s
-      imageMaximumGCAge: 168h
-      maxParallelImagePulls: 3
-      serializeImagePulls: false
-      shutdownGracePeriod: 90s
-      shutdownGracePeriodCriticalPods: 60s
-    nodeIP:
-      validSubnets:
-        - #{ network.node_cidr }#
+apiVersion: v1alpha1
+kind: KubeletConfig
+config:
+  crashLoopBackOff:
+    maxContainerRestartPeriod: 60s
+  imageMaximumGCAge: 168h
+  maxParallelImagePulls: 3
+  serializeImagePulls: false
+  shutdownGracePeriod: 90s
+  shutdownGracePeriodCriticalPods: 60s
+---
+apiVersion: v1alpha1
+kind: KubeNodeConfig
+nodeIP:
+  validSubnets:
+    - #{ network.node_cidr }#

template/config/talos/all/40-sysctls.yaml.j2

@@ -1,11 +1,12 @@
-machine:
-  sysctls:
-    fs.inotify.max_user_watches: "1048576" # Watchdog
-    fs.inotify.max_user_instances: "8192" # Watchdog
-    net.core.rmem_max: "7500000" # Cloudflared | QUIC
-    net.core.wmem_max: "7500000" # Cloudflared | QUIC
-    net.ipv4.neigh.default.gc_thresh1: "4096" # Prevent ARP cache overflows
-    net.ipv4.neigh.default.gc_thresh2: "8192" # Prevent ARP cache overflows
-    net.ipv4.neigh.default.gc_thresh3: "16384" # Prevent ARP cache overflows
-    net.ipv4.tcp_slow_start_after_idle: "0" # Preserve congestion window after idle
-    user.max_user_namespaces: "11255" # User Namespaces
+apiVersion: v1alpha1
+kind: SysctlConfig
+params:
+  fs.inotify.max_user_watches: "1048576" # Watchdog
+  fs.inotify.max_user_instances: "8192" # Watchdog
+  net.core.rmem_max: "7500000" # Cloudflared | QUIC
+  net.core.wmem_max: "7500000" # Cloudflared | QUIC
+  net.ipv4.neigh.default.gc_thresh1: "4096" # Prevent ARP cache overflows
+  net.ipv4.neigh.default.gc_thresh2: "8192" # Prevent ARP cache overflows
+  net.ipv4.neigh.default.gc_thresh3: "16384" # Prevent ARP cache overflows
+  net.ipv4.tcp_slow_start_after_idle: "0" # Preserve congestion window after idle
+  user.max_user_namespaces: "11255" # User Namespaces

template/config/talos/all/50-files.yaml.j2

@@ -1,9 +1,8 @@
-machine:
-  files:
-    - op: create
-      path: /etc/cri/conf.d/20-customization.part
-      content: |
-        [plugins."io.containerd.cri.v1.images"]
-          discard_unpacked_layers = false
-        [plugins."io.containerd.cri.v1.runtime"]
-          device_ownership_from_security_context = true
+apiVersion: v1alpha1
+kind: CRICustomizationConfig
+name: containerd
+content: |
+  [plugins."io.containerd.cri.v1.images"]
+    discard_unpacked_layers = false
+  [plugins."io.containerd.cri.v1.runtime"]
+    device_ownership_from_security_context = true

template/config/talos/all/60-encryption.yaml.tpl.j2

@@ -1,15 +1,20 @@
 {{- if .Node.Data.encryptDisk }}
 # Encrypt system disk with TPM
-machine:
-  systemDiskEncryption:
-    state:
-      provider: luks2
-      keys:
-        - slot: 0
-          tpm: {}
-    ephemeral:
-      provider: luks2
-      keys:
-        - slot: 0
-          tpm: {}
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: STATE
+encryption:
+  provider: luks2
+  keys:
+    - slot: 0
+      tpm: {}
+---
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: EPHEMERAL
+encryption:
+  provider: luks2
+  keys:
+    - slot: 0
+      tpm: {}
 {{- end }}

template/config/talos/all/61-kernel-modules.yaml.tpl.j2

@@ -1,8 +1,6 @@
-{{- if .Node.Data.kernelModules }}
-machine:
-  kernel:
-    modules:
-      {{- range .Node.Data.kernelModules }}
-      - name: {{ . }}
-      {{- end }}
+{{- range .Node.Data.kernelModules }}
+---
+apiVersion: v1alpha1
+kind: KernelModuleConfig
+name: {{ . }}
 {{- end }}

template/config/talos/all/70-security.yaml.j2

@@ -0,0 +1,7 @@
+# Talos 1.14 defaults to running kubelet and pods in a sandboxed PID/mount
+# namespace, which breaks workloads that rely on hostPID or host mounts
+# (node-exporter, GPU plugins, in-tree iSCSI). Set to true to opt in; on
+# encrypted disks expect a second reboot the first time it is enabled.
+apiVersion: v1alpha1
+kind: SecurityProfileConfig
+workloadIsolation: false

template/config/talos/all/71-filesystem.yaml.j2

@@ -0,0 +1,9 @@
+# Weekly online maintenance for XFS volumes: trim discards unused blocks
+# (SSDs, thin provisioning) and scrub checks filesystem metadata.
+apiVersion: v1alpha1
+kind: FilesystemTrimConfig
+interval: 168h0m0s
+---
+apiVersion: v1alpha1
+kind: FilesystemScrubConfig
+interval: 168h0m0s