From 2d09666e52d0898b1069569cebbd062b6fc22704 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 26 Aug 2026 08:20:25 +0000 Subject: [PATCH 1/4] chore(deps): update dependency siderolabs/talos to v1.13.9 --- .github/scripts/setup-talosctl.sh | 2 +- ksail.prod.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/scripts/setup-talosctl.sh b/.github/scripts/setup-talosctl.sh index 75674bd297..7897a640b4 100755 --- a/.github/scripts/setup-talosctl.sh +++ b/.github/scripts/setup-talosctl.sh @@ -20,7 +20,7 @@ set -euo pipefail # inspects a single node, which reads as a fleet-wide fault rather than a stale # pin. # renovate: datasource=github-releases depName=siderolabs/talos extractVersion=^v(?.+)$ -TALOS_VERSION="1.13.8" +TALOS_VERSION="1.13.9" # SHA-256 of talosctl-linux-amd64 for the TALOS_VERSION above, from that # release's sha256sum.txt. UPDATE BOTH TOGETHER. TALOSCTL_SHA256="406b56f9e4ff03b1557cc941b1f163aec8a6ebb36e28f0bbbe6d083589529261" diff --git a/ksail.prod.yaml b/ksail.prod.yaml index 1ec148211b..491131e33d 100644 --- a/ksail.prod.yaml +++ b/ksail.prod.yaml @@ -157,7 +157,7 @@ spec: talos: # Pin Talos to match the ISO so 'ksail cluster update' doesn't attempt # an unwanted in-place upgrade to ksail's default version. - version: v1.13.8 + version: v1.13.9 # Hetzner Talos ISO (x86_64). The v1.11.2 ISO (122630) was deprecated # and removed from Hetzner on 2026-03-18. Use v1.12.4 (125127). iso: 125127 From 3a1ecc5833d3c97caeeccba4b390e3598abffd4a Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 26 Aug 2026 11:29:49 +0200 Subject: [PATCH 2/4] fix(ci): move the talosctl digest with the v1.13.9 bump Renovate bumps TALOS_VERSION from its datasource but cannot move the adjacent TALOSCTL_SHA256 pin, which the script's own comment already calls out ("UPDATE BOTH TOGETHER"). The guard therefore refused the download, the merge_group "Deploy to Prod" job failed, and this PR was evicted from the merge queue. The guard classified it as a stale pin rather than tampered bytes: it read the release's published sha256sum.txt and found the served bytes matching. Digest re-verified independently against that same published file rather than copied from the CI log: talosctl-linux-amd64 7e1d4b7d5846964bdcf63a794e3c8161bb6ef2983d5ace58ea5322f3bf32a27e Co-Authored-By: Claude Opus 5 (1M context) --- .github/scripts/setup-talosctl.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/scripts/setup-talosctl.sh b/.github/scripts/setup-talosctl.sh index 7897a640b4..b5d2108cc3 100755 --- a/.github/scripts/setup-talosctl.sh +++ b/.github/scripts/setup-talosctl.sh @@ -23,7 +23,7 @@ set -euo pipefail TALOS_VERSION="1.13.9" # SHA-256 of talosctl-linux-amd64 for the TALOS_VERSION above, from that # release's sha256sum.txt. UPDATE BOTH TOGETHER. -TALOSCTL_SHA256="406b56f9e4ff03b1557cc941b1f163aec8a6ebb36e28f0bbbe6d083589529261" +TALOSCTL_SHA256="7e1d4b7d5846964bdcf63a794e3c8161bb6ef2983d5ace58ea5322f3bf32a27e" asset_name="talosctl-linux-amd64" release_base="https://github.com/siderolabs/talos/releases/download/v${TALOS_VERSION}" From cf064db3383fc8e81eab2dffb5e5b93347a1c42c Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 26 Aug 2026 13:11:10 +0200 Subject: [PATCH 3/4] fix(cluster): give the rolling drain time for Longhorn PDBs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit KSail's default per-node drain budget is 10m. The three static workers are the cluster's only Longhorn storage nodes and each holds a replica of every volume, and Longhorn pins a per-instance-manager PodDisruptionBudget at zero allowed disruptions while that instance-manager still runs engines for attached volumes. Draining a worker therefore has to evict its workloads, let those volumes detach, and wait for Longhorn to release the PDB before the instance-manager itself can be evicted — which exceeds 10m on a worker carrying several attached volumes, and an over-budget drain aborts the whole cluster update. Set drainTimeout to 30m: enough headroom for that sequence, and strictly below connection.timeout (35m) so a genuinely stuck drain still surfaces as a drain failure rather than as the outer CLI timeout. --force-drain is not the alternative, since it deletes pods bypassing PodDisruptionBudgets, which on Longhorn risks removing the instance-manager still serving a volume's last healthy replica. --- ksail.prod.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/ksail.prod.yaml b/ksail.prod.yaml index 491131e33d..3fbca3c78f 100644 --- a/ksail.prod.yaml +++ b/ksail.prod.yaml @@ -161,6 +161,25 @@ spec: # Hetzner Talos ISO (x86_64). The v1.11.2 ISO (122630) was deprecated # and removed from Hetzner on 2026-03-18. Use v1.12.4 (125127). iso: 125127 + # Per-node pod-eviction budget for the rolling drain during 'ksail + # cluster update'; KSail defaults to 10m. The static workers are the + # cluster's only Longhorn storage nodes, and Longhorn pins a + # per-instance-manager PodDisruptionBudget at zero allowed disruptions + # while that instance-manager still runs engines for attached volumes. + # Draining a worker therefore has to evict its workloads, let those + # volumes detach, and wait for Longhorn to release the PDB before the + # instance-manager itself can go — a sequence that exceeds 10m on a + # worker carrying several attached volumes, and an over-budget drain + # aborts the whole update. + # + # Kept strictly below connection.timeout (35m) so a genuinely stuck + # drain still surfaces as a drain failure rather than as the outer CLI + # timeout. + # + # --force-drain is NOT the alternative here: it deletes pods bypassing + # PodDisruptionBudgets, which on Longhorn risks removing the + # instance-manager still serving a volume's last healthy replica. + drainTimeout: 30m # Talos Image Factory extensions baked into the node image. KSail # computes the schematic ID from this list and uses it both for # machine.install.image (derived during config generation — there is no From 3d1e97a735f7b86e40fe9be2239fd5d88a882173 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 26 Aug 2026 13:34:54 +0200 Subject: [PATCH 4/4] docs(cluster): drop a false connection.timeout constraint on drainTimeout connection.timeout governs the `workload reconcile` wait on the Flux Kustomization chain; it is not consumed as `cluster update`'s outer deadline, so drainTimeout is not bounded by it. Justify the 30m value on its own terms instead: ~3x the 10m default that was reached on a worker carrying several attached volumes. --- ksail.prod.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/ksail.prod.yaml b/ksail.prod.yaml index 3fbca3c78f..aa090565c6 100644 --- a/ksail.prod.yaml +++ b/ksail.prod.yaml @@ -172,9 +172,14 @@ spec: # worker carrying several attached volumes, and an over-budget drain # aborts the whole update. # - # Kept strictly below connection.timeout (35m) so a genuinely stuck - # drain still surfaces as a drain failure rather than as the outer CLI - # timeout. + # 30m is ~3x the 10m default. That default was reached on a worker + # carrying several attached volumes, so this leaves room for the + # evict/detach/PDB-release sequence above without being unbounded. + # + # This is an independent per-node drain limit. It is NOT bounded by + # connection.timeout, which governs the `workload reconcile` wait on the + # Flux Kustomization chain and is not consumed as this update's outer + # deadline. # # --force-drain is NOT the alternative here: it deletes pods bypassing # PodDisruptionBudgets, which on Longhorn risks removing the