Breaking changes

Both presets now pin the Talos v1.14 contract. A new project from talm init renders configs that only load on nodes already running Talos v1.14. Existing projects keep their pins until talm init --update rewrites Chart.yaml, and the upgrading guide says what that command offers before you accept it.

Default Kubernetes versions move with it: cozystack v1.36.5 (was v1.34.3), generic v1.37.0 (was v1.36.2). The cozystack install image is ghcr.io/cozystack/cozystack/talos:v1.14.2.

On v1.14 the charts write the Kubernetes settings as typed documents (KubeClusterConfig, KubeNodeConfig, KubeletConfig, KubeNetworkConfig and the control-plane components) and keep only etcd in v1alpha1. Below v1.14 the rendered output is unchanged, apart from the new cozystack default image. talm apply refuses a node file rendered on an older contract: save its hand-written body, run talm template -I --file <node file>, put the body back.

Cozystack oidcIssuerUrl becomes a JWT authenticator in KubeAuthenticationConfig on v1.14, with the same claims and the <issuer># username prefix. oidc-*, anonymous-auth, authentication-config and authorization-* keys in extraApiServerArgs fail the render on v1.14.

Preset hashes changed, so projects with .talm-preset.lock report preset drift until talm init --update --preset <preset> is run.

Upgrade

• talm upgrade asks Talos before the RPC and refuses a move it will not make, a jump from too far back or a downgrade past what Talos supports. --skip-upgrade-path-check opts out. (#243)
• It warns when a node body carries an install image other than values.yaml::image, and the --image help says where the image really comes from. (#243)

Cozystack preset

• Load drbd_transport_tcp explicitly. On Talos v1.14 DRBD stays Diskless without it. (#252)
• Skip the ZFS pool export on shutdown by default, it hangs a LINSTOR-on-ZFS node in rebooting. zfs.exportOnShutdown: true brings it back. (#251)

Apply

• The dry-run diff masks multi-line secrets such as PEM keys, and the node's own side of the diff. Typed-document secrets are masked in the drift preview. (#259)
• Partial edits of a node file keep replace-merged fields and list-valued extraArgs whole. (#259)
• init --update no longer promises an interactive diff: it asks for each preset file and overwrites it whole. (#259)

CI

• golangci-lint v2.14.0. (#262)

Changelog

• 141740f Merge pull request #259 from cozystack/fix/charts-talos-v114-contract
• 0dd28fc fix(apply): mask the node's side of the dry-run diff
• 5ec4e98 fix(init): stop promising an interactive diff on preset update
• c8e651d fix(engine): keep replace-merged fields whole in node files
• 06642ce fix(apply): refuse a node file that restores superseded fields
• 901ace7 feat(charts): pin both presets to the Talos v1.14 contract
• 03d1466 fix(apply): redact secrets that live in typed documents
• 0548298 feat(charts): render the Talos v1.14 config contract
• f68e98a refactor(charts): share the advertisedSubnets list and arg indent
• 5881e65 fix(engine): merge chart Kubernetes documents into the bundle
• cfc5a95 Merge pull request #262 from cozystack/ci/golangci-lint-v2.14
• 61d9e7a ci: bump golangci-lint to v2.14.0
• b08c591 Merge pull request #251 from cozystack/fix/cozystack-zfs-export-on-shutdown
• 95c63fc fix(cozystack): skip ZFS pool export on shutdown by default
• 7f7409c Merge pull request #252 from cozystack/fix/drbd-transport-tcp
• c4f62f4 fix(cozystack): load drbd_transport_tcp explicitly
• dac1d2c Merge pull request #243 from cozystack/feat/upgrade-image-visibility
• 7203b41 feat(upgrade): refuse a move Talos will not make
• 64e2f91 fix(upgrade): warn when a node body points at a different image
• 5f13021 fix(upgrade): say where the install image actually comes from

Changelog

• 7fb8fb8 Merge pull request #223 from cozystack/chore/bump-talos-v1.14
• c997ec4 docs: record where the default installer image moved on Talos v1.14
• 3dff64c docs: name the insecure-apply flag correctly in the test plan
• e8f305f test(commands): keep pkg/commands building on Windows
• e0ac881 chore(license): keep the code ported from Talos under MPL-2.0
• 35c1fad fix(engine): report the version keys a render can no longer guess
• aaab350 fix(engine): keep every document of a rendered config
• 4ec3b5e fix(commands): keep meta --insecure reachable on Talos v1.14
• 5b4ede3 feat(applycheck): resolve the links BGP and wireguard documents name
• 4b552a9 fix(applycheck): accept veth ends as links the apply creates
• ae0bc30 chore(deps): bump Talos to v1.14.0
• 8ad47d4 Merge pull request #235 from cozystack/feat/docs-site
• b012d20 fix(values): stop claiming --set nests dots in a value
• 1223e10 docs: publish the manual as a documentation site
• c742694 docs: generate a CLI reference from the cobra command tree
• 1d571ba Merge pull request #237 from cozystack/fix/ci-lint-go127
• a6e7dc9 build: require Go 1.27
• b763f01 ci: unbreak the lint job under Go 1.27

Changelog

• 7d48e60 Merge pull request #232 from cozystack/feat/preset-values-knobs
• 5e8be43 feat(charts): add preset value knobs (#226-#230)
• c2d0f05 Merge pull request #231 from cozystack/chore/helm-4-migration
• 3612169 chore(deps): bump remaining dependencies to latest
• 4e2cb80 chore(deps): drop cozystack/talos fork for upstream v1.13.7
• e13774b chore(deps): migrate Helm library from v3 to v4
• de043ee test(engine): add full-render golden snapshots for shipped charts

Changelog

• e14fe35 Merge pull request #225 from cozystack/fix/restore-nested-virt
• 42bd818 fix(charts): stop disabling KVM nested virtualization in Talos presets

Changelog

• 6a38060 Merge pull request #224 from cozystack/security/cve-2026-53359-disable-nested-virt
• 1ff68bd fix(charts): pin grubUseUKICmdline=false so nested-virt args apply on v1.12+
• 6b58604 fix(charts): disable KVM nested virtualization in Talos presets (CVE-2026-53359)
• 90372d3 Merge pull request #216 from cozystack/feat/chart-drift-detection
• dcd0c77 Merge branch 'main' into feat/chart-drift-detection
• 170cdbe docs(manual-test-plan): note that --force bypasses the edit-preserving diff
• a49ca47 docs(readme): show .talm-preset.lock in the project tree
• edb7f84 test(cli): pin the Chart.yaml strictCharts channel and the strict-source OR
• a44d621 fix(build): classify describe-suffix and dirty builds as non-release
• 6031d46 fix(init,commands): make init --update an exact re-sync; name drifted paths
• 3dc254a fix(cli): make strict mode block on unverifiable or missing drift baselines
• e28d34e fix(commands): treat CRLF line endings as checkout artifacts, not drift
• 31b6fdb fix(init): validate inferred preset before --update writes anything
• 957c873 test(commands): pin malformed .talm-preset.lock failure modes
• 9669a55 docs(manual-test-plan): clear simulated drift with the project's own preset
• 7d564d6 fix(cli): align --strict-charts help with the actual re-sync command
• 6af1a7b fix(charts): anchor Chart.yaml metadata normalizer to top-level keys
• 5e9dfc2 feat(version): detect preset-template drift via .talm-preset.lock
• ad56f0e docs: document chart vendoring and drift detection
• 45cafe5 feat(version): warn when vendored charts drift from the talm binary
• dbc2a57 feat(commands): detect vendored charts/talm drift by content
• 8c9288b feat(charts): add content digest for the embedded talm library

Changelog

• 9babc78 Merge pull request #222 from cozystack/feat/encrypted-user-values
• 28d4270 fix(test): make value-file resolution tests cross-platform on Windows
• dc95e9a fix(apply): redact secrets in the server dry-run config diff
• 5e8e522 feat(template): keep encrypted secret values out of committed node files and previews
• 77cc49a feat(values): decrypt encrypted user value files in memory via talm.key
• 82b5ef6 feat(apply): honor value files and --set flags consistent with template

Changelog

• 2881d54 Merge pull request #217 from cozystack/fix/template-no-templates-guard
• d320cc6 fix(engine): require a template before rendering the chart
• cb340ab Merge pull request #131 from cozystack/feat/add-sysctl-etcd-defaults
• ca508b6 feat(cozystack): add DRBD-oriented sysctl and etcd backend defaults
• c3d7ace Merge pull request #212 from cozystack/fix/stdout-stderr-and-lookup-diagnostics
• bf869e4 Merge pull request #215 from cozystack/fix/lvm-loop-filter
• fbc207f test(engine): pin loop entry in lvm.conf global_filter contract
• 197fa71 fix(cozystack): exclude loop devices from LVM global_filter
• cc0239d docs(manual-test-plan): align retry section N.3 with actual iptables / cancellation semantics
• cf1008c fix(engine): route x509 SAN mismatch and other cert errors to TLSHandshake class
• cf45f7f fix(cli, engine): emit progress on stderr, enrich lookup error chain, retry transient failures

Changelog

• 62f344c Merge pull request #211 from cozystack/feat/talm-extension-points-and-upgrade-sync
• c349a05 fix(upgrade): point-patch node body install.image after successful upgrade
• e052727 feat(charts): expose Talos operator extension points in cozystack + generic presets
• 8d81fc5 fix(modeline): split modeline parts on top-level commas only

Changelog

• a0bd589 Merge pull request #209 from cozystack/chore/move-bridge-as-gateway-test
• 5d945ac chore(test): relocate bridge-as-gateway no-longer-fails pin to multidoc test file
• 6e914ea Merge pull request #208 from cozystack/feat/chart-cleanup-per-link-and-scope-filter
• c4a07a6 refactor(chart): factor v1.12 multi-doc per-link body into shared talm helper
• c9a4212 fix(chart): legacy default_addresses_by_gateway drops scope=link / nowhere too
• 0c4786a chore(chart): drop redundant int() wrapper around cidrPrefixLen calls
• e8dcbc6 Merge pull request #207 from cozystack/feat/remove-dmesg-redirect-to-logs-kernel
• 320768f docs: merge apply-safety-gates checklist into the manual test plan
• 6e0913c feat(commands): retire talm dmesg ahead of upstream, redirect operators to logs kernel
• fa94120 Merge pull request #206 from cozystack/feat/init-endpoint-and-key-hints
• 31a27cd feat(init): --cluster-endpoint flag and single-endpoint auto-derive for values.yaml
• 352c1e7 fix(init): hint at talm.key recovery path when --decrypt fails
• a0301e7 Merge pull request #204 from cozystack/feat/commands-followups
• 8f17918 chore: strip issue and ticket references from public artifacts
• 43d5f2a feat(commands): rich shell autocompletion for presets, modes, files, talosconfig
• 125948a feat(apply): first -f file anchors project root; later files are patches
• 0b22793 fix(upgrade): take target image from values.yaml, not rendered node body
• 350c6d4 fix(template): preserve operator comments above modeline on in-place rewrite
• e1b0688 feat(engine,template): warn on IP-shaped --set values; document --set-string
• c41aca4 fix(init): drop redundant error wrap when --preset is missing on --update
• 9cdcaeb Merge pull request #203 from cozystack/test/vip-empty-bond-skip-regression-pin
• 333058f test(engine): pin empty-bond skip under VIP-active path

Note

This release carries forward the -n shorthand drop introduced in v0.28.0. Update scripts using talm <cmd> -n <IP> to talm <cmd> --nodes <IP>. See the v0.28.0 release notes for the rationale.

Changelog

• 92ffd52 Merge pull request #202 from cozystack/fix/talosconfig-honor-endpoints
• 1191b22 fix(commands): honor --endpoints in talosconfig regenerate flow