3790 Commits

Author SHA1 Message Date
Andrey Smirnov
ff83d9fd7b
fix: improve talosctl completion
This got broken with a sequence of changes related to not unmarshalling
resources when using `get`.

Rewrite the completion to be more straightforward and use easier
methods.

Make shell completion work even when `nodes` are not set.

Fixes #6646

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-19 18:55:24 +04:00
Samuel Kees
31ff431fae
chore: add schulz systemtechnik to the list
Add SCHULZ Systemtechnik GmbH to adopters list.

Signed-off-by: Samuel Kees <83597284+samuelkees@users.noreply.github.com>
Signed-off-by: Noel Georgi <git@frezbo.dev>
2022-12-19 19:24:26 +05:30
Rowan Smith
97bef7c47b
docs: vsphere.sh > vmware.sh
The docs at https://www.talos.dev/v1.3/talos-guides/install/virtualized-platforms/vmware/ mentions

>Download the vmware.sh script to your local machine. You can do this by issuing curl -fsSLO "https://raw.githubusercontent.com/siderolabs/talos/master/website/content/v1.3/talos-guides/install/virtualized-platforms/vmware/vmware.sh".

But the command example refers to it as `vsphere.sh`. This changes it to `vmware.sh`

Signed-off-by: Rowan Smith <86935689+rowansmithhc@users.noreply.github.com>
Signed-off-by: Noel Georgi <git@frezbo.dev>
2022-12-19 18:52:18 +05:30
Niklas Wik
34babe858d
chore: make organization selection an interface
Making organization a interface for preparing to avoid giving
system:masters access to the talosctl kubeconfig generated certificate.

Signed-off-by: Niklas Wik <niklas.wik@nokia.com>
Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-19 15:12:30 +04:00
Andrey Smirnov
a9643b4774
fix: use proper key usage for apid client certificate
This command is referenced from PKI recovery documentation.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-19 14:33:42 +04:00
Nico Berlee
171aa94679
fix: disable Wireless Lan using dtoverlay
Talos has no wireless support & wireless kernel drivers,
so disabling it the recommended way might actually might save power consumption.

It could save ~45 mA:
https://forums.raspberrypi.com/viewtopic.php?t=257144#p1568474

Or 'The WiFi half of the wireless chip will be powered but be held in reset':
https://forums.raspberrypi.com/viewtopic.php?t=343854#p2060246

Either way, it does not hurt and it should be treated the same as bluetooth.

Signed-off-by: Nico Berlee <nico.berlee@on2it.net>
Signed-off-by: Noel Georgi <git@frezbo.dev>
2022-12-17 01:48:43 +05:30
Andrey Smirnov
2e84d2ab34
chore: update conformance product.yaml
New requirements from CNCF.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-16 14:44:34 +04:00
Steve Francis
b7763843af
feat: add install script that improves talosctl installation user experience
This install script detects the platform and architecture, and downloads the correct talosctl, and checks the gpg checksums.
It also installs and chmods the binary.

Signed-off-by: Andrew Rynhard <andrew@rynhard.io>
2022-12-15 11:13:13 -08:00
Andrey Smirnov
afc45ad632
docs: mark Talos 1.3 docs as default
Just in time for Talos 1.3.0.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-15 17:04:36 +04:00
Utku Ozdemir
873bd3807c
fix: redact service account key in config in RedactSecrets method
Include the previously missing service account key field in the redaction.

Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>
2022-12-15 12:49:40 +01:00
Utku Ozdemir
b3aebfadfc
feat: validate Talos API access roles in machine config
Make sure that machine config rejects unknown roles in Talos API access config if the feature is enabled.

Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>
2022-12-15 11:39:51 +01:00
Andrey Smirnov
40761e17db
docs: fork docs for Talos 1.4
Start new docs for v1.4.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-14 22:43:56 +04:00
Andrey Smirnov
474604cd27
docs: update documentation for Talos 1.3
This provides What's New, updates documentation with new features,
clarifications and fixes.

I added also simple bare-metal stubs for ISO and PXE methods.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-14 22:01:55 +04:00
Noel Georgi
faf49218ce
feat: add more checks for K8s upgrade
Add more checks for the Talos Kubernetes upgrade.

The removed api-server resources checks are kept as is, needs to be
moved to the new checks as part of #6599.

Fixes: #6444

Signed-off-by: Noel Georgi <git@frezbo.dev>
2022-12-14 19:29:19 +05:30
Andrey Smirnov
5b992bd861
fix: allow empty dnsDomain in machine config
This field has a default value, but validation was prohibiting empty
value.

Fixes #6619

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-12 16:01:36 +04:00
Dmitriy Matrenichev
eb332cfcb7
feat: add health check for a minimal memory / disk size
This PR adds two additional checks which are performed during boot sequence and in `talosctl health`. They ensure that nodes have enough memory and disk.

- Boot check will print a warning if memory / disk size is not sufficient.
- Health check will fail if memory / disk size is not sufficient.

Closes #6467

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>
2022-12-10 07:05:08 +03:00
Andrey Smirnov
d04970dfa9
fix: ignore k8s additional addresses if nil
This fixes a potential panic which I found in the unit-tests logs.

The error 'not found' is ignored, so need an addiitonal check.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-09 19:25:07 +04:00
Andrey Smirnov
63c17104c5
feat: update Kubernets to 1.26.0
See https://github.com/kubernetes/kubernetes/releases/tag/v1.26.0

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-09 18:13:35 +04:00
Andrey Smirnov
f7a9a90db2
chore: update pkgs/tools (Go 1.19.4, containerd 1.6.11)
Update to the latest pkgs/tools to fix the build due to vulncheck.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-09 17:25:47 +04:00
Utku Ozdemir
cf7adc51c9
feat: add RedactSecrets method to v1alpha1.Config
Add a way to strip away the secrets from a config.

Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>
2022-12-08 13:03:51 +01:00
Michael Vorburger
4c31b9b1a3
docs: clarify what the deal is with /var
Explain when EPHEMERAL gets wiped.

Signed-off-by: Michael Vorburger ⛑️ <mike@vorburger.ch>
Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-07 00:05:22 +04:00
Dmitriy Matrenichev
a8ebcca4a9
chore: remove watchErr from metal.getResource
It's only used to detect if resource is `nil` or of incorrect type. Both errors are developer errors, so we should not collect them.

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>
2022-12-06 22:04:28 +03:00
Dmitriy Matrenichev
1253513bd1
fix: fix nil pointer panic and incorrect error output
Currently `.Error()` call is panicking if `watchErr` is nil. Besides - we want to wrap errors the way we can unwrap them.

Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>
2022-12-06 21:03:25 +03:00
Andrey Smirnov
82e8c9e1f6
fix: workaround panic in the kubelet service controller
The traceback:

```
user: warning: [2022-12-02T17:31:09.496341098Z]: [talos] controller failed {"component": "controller-runtime", "controller": "k8s.KubeletServiceController", "error": "controller \x5c"k8s.KubeletServiceController\x5c" panicked: runtime error: invalid memory address or nil pointer dereference\x5cn\x5cngoroutine 308 [running]:\x5cnruntime/debug.Stack()\x5cn\x5ct/toolchain/go/src/runtime/debug/stack.go:24 +0x65\x5cngithub.com/cosi-project/runtime/pkg/controller/runtime.(*adapter).runOnce.func2()\x5cn\x5ct/.cache/mod/github.com/cosi-project/runtime@v0.1.1/pkg/controller/runtime/adapter.go:403 +0x5d\x5cnpanic({0x2b7b600, 0x536c7c0})\x5cn\x5ct/toolchain/go/src/runtime/panic.go:884 +0x212\x5cngithub.com/talos-systems/talos/internal/app/machined/pkg/controllers/k8s.updateKubeconfig(0xc0000d49b0?)\x5cn\x5ct/src/internal/app/machined/pkg/controllers/k8s/kubelet_service.go:302 +0xb8\x5cngithub.com/talos-systems/talos/internal/app/machined/pkg/controllers/k8s.(*KubeletServiceController).Run(0xc000956030, {0x389f7c0, 0xc000808040}, {0x38bce60, 0xc0000dfa80}, 0x0?)\x5cn\x5ct/s...
```

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-06 20:53:30 +04:00
Andrey Smirnov
a505b8909a
fix: update COSI and reset restart backoff on success
See https://github.com/cosi-project/runtime/pull/191

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-06 17:43:26 +04:00
Noel Georgi
e92fdcbad1
chore: bump kernel to 5.15.81
Bump kernel to [5.15.81](https://github.com/siderolabs/pkgs/pull/622)

Signed-off-by: Noel Georgi <git@frezbo.dev>
2022-12-05 20:07:49 +05:30
Andrey Smirnov
f0dddca2a3
docs: expand help for 'talosctl get'
Make it more obvious how to get list of all resources.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-05 17:42:28 +04:00
Andrey Smirnov
fcffc88790
fix: add ext4 filesystem detection
Fixes #6483

See https://github.com/siderolabs/go-blockdevice/pull/66

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-05 14:42:18 +04:00
Andrey Smirnov
5b2960efff
fix: introduce 'overridePath' setting and fix Talos resolver
There was inconsistency in the way `/v2` was appended to registry
endpoint path between containerd (CRI) and Talos:

* Talos only appended `/v2` to empty paths
* containerd appended `/v2` if it's not the suffix already

Fix Talos to act same as containerd, and introduce a setting
`overridePath` which stops both Talos and `containerd` from appending
`/v2` (should be required with e.g. Harbor registry mirror).

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-05 12:50:53 +04:00
Andrey Smirnov
0219d1124e
fix: use only kube-apiserver endpoints for Talos API access endpoints
Fixes #6566

This avoid putting all node addresses which might not be routeable
across Kubernetes.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-02 22:27:55 +04:00
Andrey Smirnov
dc5e0f4af0
fix: report errors to Equinix Metal event API
This provides more detailed event for better error analysis.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-02 21:24:00 +04:00
Utku Ozdemir
7ab140a94a
feat: add talosctl machineconfig patch command
Add talosctl machineconfig patch command which accepts a machine config as input and a list of patches, applying the patches and writing the result to a file or to stdout.

Link `talosctl machineconfig gen` to `talosctl gen config`, so they work the same way.

Closes siderolabs/talos#6562.

Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>
2022-12-02 15:42:48 +01:00
Andrey Smirnov
d3cf061149
fix: ignore many more filesystems in IMA
Fixes #6553

Talos itself defaults to XFS, so IMA measurements weren't done for Talos
own filesystems. But many other solutions create by default ext4
filesystems, or it might be something mounted by other means.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-01 20:16:41 +04:00
Utku Ozdemir
44e2799b8c
feat: add stdout and single config type support to talosctl gen config
Add support to specify the types of outputs to be generated by talosctl gen config.

Add support for writing a single type of output to stdout instead of a file.

Related to siderolabs/talos#6562.

Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>
2022-12-01 16:55:22 +01:00
Noel Georgi
4452f0e179
docs: bump talos version
Bump last released Talos version.

Signed-off-by: Noel Georgi <git@frezbo.dev>
2022-12-01 20:00:26 +05:30
Andrey Smirnov
38e57bd12b
feat: update Kubernetes to v1.26.0-rc.1
See https://github.com/kubernetes/kubernetes/releases/tag/v1.26.0-rc.1

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-01 14:53:36 +04:00
Andrey Smirnov
4cd125d499
fix: correctly handle new watch event types
This is a fix after upgrade to COSI v0.2.0.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-12-01 13:53:22 +04:00
Andrey Smirnov
881b841520
feat: update Flannel to 0.20.2
See https://github.com/flannel-io/flannel/releases/tag/v0.20.2

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-30 19:30:27 +04:00
Andrey Smirnov
2ebe410e93
feat: update COSI to v0.2.0
This brings many fixes, including a new Watch with support for
Bootstapped and Errored event types.

`talosctl` from before this change is still compatible, as there's gRPC
API level backwards compatibility versioning.

New client doesn't yet depend on new event types, so it will work
against Talos 1.2.x.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-29 21:21:59 +04:00
Andrey Smirnov
00388651b2
chore: bump pkgs and Go dependencies
Update Linux to 5.15.80, final tagged versions of pkgs/tools/extras for
Talos 1.3.0.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-29 15:20:09 +04:00
Andrey Smirnov
bbb56840e4
chore: update protobuf API descriptors for 1.3.0
Set the API descriptors for v1.3.0.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-29 14:41:43 +04:00
Andrey Smirnov
fdbd380f60
feat: use 'registry.k8s.io' for Kubernetes images
See https://kubernetes.io/blog/2022/11/28/registry-k8s-io-faster-cheaper-ga/

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-28 14:13:54 +04:00
Andrey Smirnov
1103c5ad24
feat: implement pre-flight checks in the installer
Host Talos mounts machined socket for API access into the installer
container (for upgrades).

Installer runs any check it might need to verify compatibility.

At the moment following checks are implemented:

* Talos version (whether upgrade from version X to Y is supported)
* Kubernetes version (whether Kubernetes version X is supported with
  Talos Y).

Fixes #6149

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-28 13:45:49 +04:00
Andrey Smirnov
4a052eadf3
fix: disable kexec on upgrades from pre-BTF kernel
Enabling BTF in the kernel brakes kexec from pre-BTF kernel (e.g. when
upgrading from 1.2.x to 1.3.x).

As there's no way to detect Talos version in the installer at the
moment, use another way to detect whether BTF is enabled in the Talos
version which is running right now.

Fixes #6443

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-24 22:48:39 +04:00
Andrey Smirnov
732c459ecf
fix: parse and apply DHCP settings properly from cmdline
This allows multiple `ip=` parameters, and fixes setting DHCP for any
link on the cmdline.

Fixes #6475

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-24 21:47:29 +04:00
Alexandre Mclean
a9e9d71b24
fix: parse correctly upgrade cmd force flag
It was using value of a variable boud to another flag.

Signed-off-by: Alexandre Mclean <alexandre.mclean@gmail.com>
Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-24 20:07:23 +04:00
Andrey Smirnov
e85e64d6f8
docs: document metal-iso configuration method
This exists in the code, but it's not documented properly.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-24 19:48:20 +04:00
Steve Francis
c27adbe541
docs: update getting started
Fixed typos, added info about how to detect disks, simplified.

Signed-off-by: Steve Francis <steve.francis@talos-systems.com>
2022-11-24 14:09:41 +01:00
Andrey Smirnov
260684a930
chore: use build-container image for s3cmd
Looks like s3cmd image is broken now.

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-24 16:32:08 +04:00
Andrey Smirnov
ee7a4777af
chore: bump dependencies
Linux 5.15.79, containerd 1.6.10

Other changes come from:

* https://github.com/siderolabs/toolchain/pull/57
* https://github.com/siderolabs/tools/pull/244
* https://github.com/siderolabs/pkgs/pull/619
* https://github.com/siderolabs/extras/pull/67

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
2022-11-22 23:47:05 +04:00