chore: backports for v1.13.10 - #14201
Open
shanduur wants to merge 20 commits into
Open
Conversation
Talos chmods and chowns the mount root after mounting a read-write volume. For external volumes the mount root belongs to the host: on Apple Virtualization.framework (UTM, tart) the virtiofs server runs unprivileged and the share root may be synthetic, so the chmod fails with EPERM and the mount is rolled back into a retry loop. Where the chmod does succeed (virtiofsd running as root under qemu) it silently rewrites the host share directory to 0755 root:root, which is also wrong. Fixes siderolabs#14058 Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit 4c575c2)
Prevent stale trailing bytes when a shorter extension file replaces an existing destination during extension assembly. Signed-off-by: Dima Aratin <39628042+staners2@users.noreply.github.com> Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit 5fcf360)
RouteSpecController subscribes to RTMGRP_LINK|RTMGRP_IPV4_ROUTE, so a configured route deleted out of band is reconciled only when it is IPv4. On an IPv6-only network the route stays missing until an unrelated event wakes the controller. The watcher is already wrapped in a rate-limited trigger, so watching the second family does not increase the reconciliation rate under churn. Signed-off-by: Max Makarov <maxpain@linux.com> Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 63bd62c)
See https://github.com/coredns/coredns/releases/tag/v1.14.7 Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 41c0c0a)
The biggest issue was that the default etcd client behavior is to wait for the connection to be ready, so when hitting a dead endpoint, the call would hang for the whole timeout period instead of moving to the new one. Also optimize even more by ordering the endpoints starting from the ones which are most likely to succeed: advertised other client members addresses, excluding self (a learner can't promote itself), then other addresses which might provide fallback if the advertised addresses are not reachable for any reason. Fixes siderolabs#14097 Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit f80fd09)
The installer creates the meta partition from scratch, so any in-memory values are lost unless flushed: e.g. tags seeded via talos.environment=INSTALLER_META_BASE64 while running in maintenance mode, or values set at runtime via the meta api. The normal install sequence handles this with its reload/flush tasks, but lifecycle service installs and unattended installs skip it. add install.ReloadMeta/install.SyncMeta helpers (wait for volume ready, then reload/flush) and call them after the installer runs in both paths; reuse SyncMeta for the sequencer flush task. Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit a469e96)
SELinux label was applied unconditionally on mount, ignoring the same read-only/detached/external exclusions already used for target settings. For a read-only existing volume this attempted to relabel a target it must not touch. Unify both checks under one shouldUpdateTargetSettings gate. Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit 1bb6e1f)
The etcd snapshot upload truncated the snapshot file in place, and removed it when the upload failed. The etcd recovery reads that same file, and it runs after the bootstrap API has already returned success. This way, an upload repeated during a running recovery cut the snapshot short and left a partial etcd data directory behind, and every bootstrap after that got rejected. Write the upload to a temporary file next to the snapshot and move it into place only once it is complete. A running recovery keeps reading the snapshot it started with, and a failed upload removes only its own temporary file. Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com> (cherry picked from commit 48fe469)
Rekor 1.5.4 transitively drops the vulnerable golang.org/x/crypto/openpgp usage, so GO-2026-5932 no longer needs suppression. Refresh GO-2026-4736 TTL and clean up indirect dependencies (go-openapi, relic v8, prometheus, google cloud libs) and remove unused blang/semver. Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit 1b1905a)
Valid tar archives can contain nested file entries without separate directory headers first. This makes Untar create parent directories before extracting file and symlink entries, so user-supplied imager tarballs extract successfully. Signed-off-by: immanuwell <pchpr.00@list.ru> Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 1e31ded)
This should be defense-in-depth, as the untar is usually passed trusted input - either an extension image, or the Talos Read API result, but it's better to stay on the safe side, and protect from malicious tar structure by restricting the extraction to the provided root. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 9c747cb)
OpenFile with the full mode (setuid/setgid/sticky) can fail inside the chroot/imager extraction path. Apply only the permission bits at creation and let the subsequent Chmod set the special bits. Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com> (cherry picked from commit 770e5cd)
Reduce the noise. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 6f7b08a)
Fixes issue siderolabs#14164 Based on siderolabs@a705a38 63bd62c (cherry-picked to release-1.14 as 7ac3cad), introduces RTMGRP_IPV6_ROUTE to the controller's RtNetlink watcher, which triggers the controller's wake-ups. As reported in pull siderolabs#14085 (siderolabs#14085), before subscribing to RTMGRP_IPV6_ROUTE, deleting an IPv6 route out-of-band (not through Talos config documents), would leave the actual route missing until the subsequent controller wake-up. This however, combined with how Linux implicitly handles the scope field for the IPv6 family, created an unwanted side effect, resulting in the controller endlessly churning IPv6 route creation. This churn rate waas capped only by the RateLimitedTrigger, which is using the default configuration limits of 10 events/sec (with a burst of 5). This perfectly matches the observed behavior of IPv6 routes reconciling every 100ms. Now for how the kernel handles route scope in the IPv6 family. The kernel accepts any scope on RTM_NEWROUTE, regardless of family type. However, the route scope is an IPv4-only concept, and this field is dropped when an IPv6 route is being stored into the forwarding table (FIB). The IPv6 FIB (fib6_info struct) doesn't even have an equivalent scope field. Then, when we read the routes back in the RouteSpecController, with the intent of comparing the actual route's scope against the desired one (as defined by the RouteSpec documents), the kernel always fills the returned route's scope with RT_SCOPE_UNIVERSE (nethelpers.ScopeGlobal), in rt6_fill_node(). Then, if the IPv6 route's desired scope is not set to ScopeGlobal, the actual route is considered out of sync, and the controller writes the route. Writing the IPv6 route causes a RTMGRP_IPV6_ROUTE event to be emitted, our RtNetlink watcher is triggered, which wakes our controller, which leads to the same reconciliation, which completes the cycle and results in the endless IPv6 route creation loop. To mitigate the above, we must only assert the scope for non-IPv6 routes. Co-authored-by: Sacha Trémoureux <sacha@tremoureux.fr> Signed-off-by: Maja Bojarska <maja.bojarska@siderolabs.com> (cherry picked from commit f7065d3)
See https://github.com/cosi-project/runtime/releases/tag/v1.16.3 Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 6b1d184)
Protect some META keys which are completely owned by Talos itself to be not writeable via the API. Also block writes for zero value, as it used internally in the META format and it will provide inconsistent output. Add integration tests. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit d5f53ed)
shanduur
marked this pull request as ready for review
September 1, 2026 11:38
shanduur
marked this pull request as draft
September 1, 2026 11:38
shanduur
force-pushed
the
release/v1.13.10
branch
from
September 1, 2026 11:52
9d16dfe to
0d92564
Compare
shanduur
marked this pull request as ready for review
September 1, 2026 11:56
shanduur
added
the
integration/release-gate
shanduur
force-pushed
the
release/v1.13.10
branch
from
September 1, 2026 12:09
0d92564 to
f8e5f2c
Compare
The output to tview might be re-processed by tview for its own color tags, so ensure any input data is escaped before drawn into tview. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 6ee4612)
The fix is similar to siderolabs#14117, but applied to the `talosctl` CLI path - when processing the tarball (received via Talos API), ensure that the extraction doesn't leave the extract root path, and avoid setting dangerous file mode bits (e.g. setuid), as it makes no sense, as extraction doesn't preserve the owner's uid. The produced tarball still contains raw data, so it can be used to do full analysis without extraction as required. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 1ee84b2)
Update pkgs to v1.13.0-65-g9b044c5 Update tools to v1.13.0-11-g7791f48 Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>
shanduur
force-pushed
the
release/v1.13.10
branch
from
September 1, 2026 12:11
f8e5f2c to
df9b82d
Compare
Update ETCD to v3.6.14 Update github.com/insomniacslk/dhcp to 0.0.0-20260719225207-c76316d4aa82 Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>
shanduur
removed
the
integration/release-gate
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update pkgs to
v1.13.0-65-g9b044c5Update tools to
v1.13.0-11-g7791f48