v1.7.0-beta.0

[oguzkilcan]

Omni 1.7.0-beta.0 (2026-04-09)

Welcome to the v1.7.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Browsable Audit Logs in the UI

Audit logs are now browsable directly in the Omni UI, making it easier to review audit events without CLI access.

Human-Readable Config Validation Errors

Configuration validation errors are now presented in a human-readable format, making it easier to diagnose and fix configuration issues.

Direct Talos Node Access via SideroLink

All Talos nodes can now be accessed directly via their SideroLink endpoint, removing the need to route through the load balancer for Talos API calls. Allowing direct access to worker nodes when control plane nodes are unavailable.

Kubernetes Manifests Sync

Omni now supports syncing Kubernetes manifests directly to managed clusters. Manifests can be defined in cluster templates, allowing declarative management of Kubernetes resources alongside cluster configuration.

omnictl edit Command

A new omnictl edit command has been added, allowing users to edit Omni resources interactively from the CLI.

Workload Proxy Subdomain Options

The workload proxy now supports an empty subdomain configuration and a new useOmniSubdomain option, providing more flexibility in how workload proxy URLs are structured.

Contributors

• Edward Sammut Alessi
• Utku Ozdemir
• Artem Chernyshev
• Oguz Kilcan
• Andrey Smirnov
• Orzelius
• Dmitriy Matrenichev
• Hector Monsalve

Changes

62 commits

• 4352f3cb release(v1.7.0-beta.0): prepare release
• 9b09e8b0 fix: apply --force-context-name on initial kubeconfig creation
• 3251d142 fix: batch SQLite cleanup deletes to reduce write lock contention
• b6e3280a chore: bump go to v1.26.2
• 9201358b chore: bump dependencies and rekres
• e4760526 feat: support omnictl edit command
• 78bfa12a chore: collect metrics on the initial Collect call to avoid empty data
• 43be52c7 chore: bump sqlite metrics collector timeout and interval
• 5db4dbfa test: lock prepared for Omni upgrade cluster, then check pending changes
• 76d0c6a2 chore: extract sqlite metrics collector into a separate goroutine
• 68305854 chore(frontend): bump yaml to 2.8.3
• f0dd48f3 feat(frontend): place machine labels on new line for cluster scale/create
• d10f1f1c fix: log errors from the metrics endpoint handler
• 5edcef1f refactor(frontend): drop the views/cluster folder
• 65c6b804 refactor(frontend): drop the components/common folder
• cc71b5b5 refactor(frontend): drop the views/omni folder
• 0e66352f fix: fix stale writes of MachineRequestStatus in infra provider lib
• 2bb49a95 fix(frontend): fix useclusterpermissions not reacting to cluster changes
• 1bbe869b fix: clean up stale identity last active resources on identity removal
• a366efb9 fix: add missing cluster relations to resource types
• ff5d9beb test: add e2e tests for key expiration
• 6efb0f2f feat: support Kubernetes manifests in the cluster templates
• 73f3079f fix(frontend): hide machine tutorial card if we have machines
• fe7c1beb fix(frontend): fix ui error on cluster all nodes page
• e46d9420 fix(frontend): prevent invalid auth states in frontend
• b720fc30 fix(frontend): prevent saving unconfirmed keys
• 2a863fcf chore: rewrite cluster workload proxy controller to use manifests
• 7cb5ba3c feat(frontend): introduce browsable audit logs in the frontend
• 2b39af72 refactor(frontend): abort useresource get/list queries on unmount
• c6f2413d fix: enable Teardown audit logs
• 26798512 chore: bump deps, rekres, Talos 1.12.6, Kubernetes 1.35.3
• 44c0d0e2 feat: update omnictl version warning text
• 72dfad7d feat: update github issue templates
• 53f94596 fix(frontend): address login race conditions
• ada03608 feat: add a way to sync Kubernetes manifests in Omni
• d6f50a7f fix: disable client IP reporting in embedded discovery service
• 3b2f6daa feat(frontend): refactor watch to allow watch singletons outside of components
• 027ff314 fix(frontend): respect embedded discovery checkbox in cluster create
• b9cabbd9 feat: add deprecation notification for non-ImageFactory machines
• 21a08702 chore(frontend): bump monaco-editor to 0.55.1
• 7699f5e7 chore(frontend): bump frontend deps
• 5b29817f fix: restore resolved node address fallback
• 56b6a90f feat: make config validation errors human-readable
• 9052ebc2 fix: allow Talos API read and copy methods
• cfb18f36 chore: rewrite machine status link as qcontroller
• c7f60c0c feat: access all Talos nodes directly via their SideroLink endpoint
• 311f75ce feat(frontend): remove cookie consent banner
• 2977f053 feat: allow empty subdomain for workload proxy
• d5862a27 fix(frontend): prevent flashing no access during login
• e85ab384 fix: correct SQLite size metrics to include indexes and freelist
• 621d3f44 fix: fix panics in diff algorithms
• 90d73211 fix: use dynamic SQLite pool
• 1fc2e01f fix: track load balancer port allocations in-memory
• e35ff83f fix: load balancer health status diff and stopped status race
• 25926b5d feat: add useOmniSubdomain option for workload proxy
• d18e9580 refactor(frontend): make currentuser and permissions reactive
• ac35cdd4 refactor(frontend): migrate to file based routing
• 211bbc23 chore: export the SQLite memory allocator stats
• df236c3d fix: remove Election.Resign call to fix data race with Campaign
• 913d7246 fix: add omnictl backward compatibility with older Omni servers
• 936166b2 chore(frontend): bump dependencies, including vite 8
• 6370b41c test: re-fetch machine IPs in AssertTalosVersion retry loop

Changes from siderolabs/crypto

1 commit

• 6d82f0c fix: bump minimum TLS version to v1.3

Changes from siderolabs/discovery-service

4 commits

• f1fdd95 release(v1.0.17): prepare release
• 2267f4c feat: store relative expiration (TTL) instead of absolute
• f708818 release(v1.0.16): prepare release
• 379016a feat: add option to disable client IP reporting in Hello response

Changes from siderolabs/go-kubernetes

5 commits

• 503792d chore: add retry to main kubernetes operations
• 6a00c4f feat: handle CR defined alongside their CRD in the same apply
• 4ff2602 feat: update deprecations to Kuberntes 1.36.0-beta.0
• 691a26b feat: add StateProvider for per-node COSI state in upgrade checks
• 92163c3 fix: set a the context logger

Changes from siderolabs/go-talos-support

2 commits

• 6ec24a7 feat: add per-node Talos client provider for support bundle collection
• 5e0155f fix: add trailing new line when writing to logger

Changes from siderolabs/grpc-proxy

3 commits

• d670c42 chore: bump dependencies
• 8614c71 chore: bump deps
• 80677e0 fix: propagate the headers before the message

Changes from siderolabs/proto-codec

1 commit

• 9b8a14e chore: bump dependencies

Changes from siderolabs/siderolink

1 commit

• 0a1933c chore: bump dependencies

Dependency Changes

• github.com/ProtonMail/gopenpgp/v2 v2.9.0 -> v2.10.0
• github.com/aws/aws-sdk-go-v2 v1.41.3 -> v1.41.5
• github.com/aws/aws-sdk-go-v2/config v1.32.11 -> v1.32.14
• github.com/aws/aws-sdk-go-v2/credentials v1.19.11 -> v1.19.14
• github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.6 -> v1.22.12
• github.com/aws/aws-sdk-go-v2/service/s3 v1.96.4 -> v1.98.0
• github.com/aws/smithy-go v1.24.2 -> v1.24.3
• github.com/cosi-project/runtime v1.14.0 -> v1.14.1
• github.com/cosi-project/state-sqlite v0.3.0 -> v0.4.0
• github.com/fluxcd/pkg/ssa v0.70.0 new
• github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
• github.com/google/go-containerregistry v0.21.2 -> v0.21.4
• github.com/hashicorp/vault/api v1.22.0 -> v1.23.0
• github.com/hashicorp/vault/api/auth/kubernetes v0.10.0 -> v0.12.0
• github.com/siderolabs/crypto v0.6.4 -> v0.6.5
• github.com/siderolabs/discovery-service v1.0.15 -> v1.0.17
• github.com/siderolabs/go-kubernetes 8364adde8878 -> v0.2.36
• github.com/siderolabs/go-talos-support v0.1.4 -> v0.2.0
• github.com/siderolabs/grpc-proxy v0.5.1 -> v0.5.2
• github.com/siderolabs/omni/client v1.5.9 -> v1.6.1
• github.com/siderolabs/proto-codec v0.1.3 -> v0.1.4
• github.com/siderolabs/siderolink v0.3.15 -> v0.3.16
• github.com/siderolabs/talos/pkg/machinery cc636f1dd1f1 -> v1.13.0-beta.1
• github.com/spf13/pflag v1.0.10 new
• github.com/zitadel/oidc/v3 v3.45.5 -> v3.46.0
• go.etcd.io/etcd/client/pkg/v3 v3.6.8 -> v3.6.10
• go.etcd.io/etcd/client/v3 v3.6.8 -> v3.6.10
• go.etcd.io/etcd/server/v3 v3.6.8 -> v3.6.10
• golang.org/x/crypto v0.48.0 -> v0.49.0
• golang.org/x/net v0.51.0 -> v0.52.0
• golang.org/x/text v0.34.0 -> v0.35.0
• golang.org/x/tools v0.42.0 -> v0.43.0
• google.golang.org/grpc v1.79.2 -> v1.80.0
• k8s.io/api v0.35.2 -> v0.35.3
• k8s.io/client-go v0.35.2 -> v0.35.3
• sigs.k8s.io/cli-utils v0.37.2 new

Previous release can be found at v1.6.0

---

This discussion was created from the release v1.7.0-beta.0.