From 6b6b1b9ffedf7b15aba167444f7a6fbe99cd7243 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 22 Sep 2026 08:01:50 +0000 Subject: [PATCH 1/3] chore(deps): update dependency siderolabs/talos to v1.14.0 --- .github/scripts/setup-talosctl.sh | 2 +- ksail.prod.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/scripts/setup-talosctl.sh b/.github/scripts/setup-talosctl.sh index b5d2108cc3..53551e695c 100755 --- a/.github/scripts/setup-talosctl.sh +++ b/.github/scripts/setup-talosctl.sh @@ -20,7 +20,7 @@ set -euo pipefail # inspects a single node, which reads as a fleet-wide fault rather than a stale # pin. # renovate: datasource=github-releases depName=siderolabs/talos extractVersion=^v(?.+)$ -TALOS_VERSION="1.13.9" +TALOS_VERSION="1.14.0" # SHA-256 of talosctl-linux-amd64 for the TALOS_VERSION above, from that # release's sha256sum.txt. UPDATE BOTH TOGETHER. TALOSCTL_SHA256="7e1d4b7d5846964bdcf63a794e3c8161bb6ef2983d5ace58ea5322f3bf32a27e" diff --git a/ksail.prod.yaml b/ksail.prod.yaml index fd8b401f23..d1908824f6 100644 --- a/ksail.prod.yaml +++ b/ksail.prod.yaml @@ -155,7 +155,7 @@ spec: talos: # Pin Talos to match the ISO so 'ksail cluster update' doesn't attempt # an unwanted in-place upgrade to ksail's default version. - version: v1.13.9 + version: v1.14.0 # Hetzner Talos ISO (x86_64). The v1.11.2 ISO (122630) was deprecated # and removed from Hetzner on 2026-03-18. Use v1.12.4 (125127). iso: 125127 From 5ee1e3e0a8b6dd7989ca628dd7a69707600c6845 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 22 Sep 2026 22:24:04 +0200 Subject: [PATCH 2/3] chore(deps): pin the talosctl digest that goes with Talos v1.14.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renovate bumps TALOS_VERSION from its datasource but cannot know the matching digest, so this bump left the adjacent pair inconsistent and the install-time verification failed closed — exactly as setup-talosctl.sh is written to do. Verified three ways rather than trusting the CI message: the bytes served for talosctl-linux-amd64 at v1.14.0 hash to 2c147c4a99d1…, that release's published sha256sum.txt names the same digest, and both equal the value pinned here. The previous pin (7e1d4b7d…) is v1.13.9's, which is why the check went red. Co-Authored-By: Claude Opus 5 (1M context) --- .github/scripts/setup-talosctl.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/scripts/setup-talosctl.sh b/.github/scripts/setup-talosctl.sh index 53551e695c..9a2f780201 100755 --- a/.github/scripts/setup-talosctl.sh +++ b/.github/scripts/setup-talosctl.sh @@ -23,7 +23,7 @@ set -euo pipefail TALOS_VERSION="1.14.0" # SHA-256 of talosctl-linux-amd64 for the TALOS_VERSION above, from that # release's sha256sum.txt. UPDATE BOTH TOGETHER. -TALOSCTL_SHA256="7e1d4b7d5846964bdcf63a794e3c8161bb6ef2983d5ace58ea5322f3bf32a27e" +TALOSCTL_SHA256="2c147c4a99d124c95bd5c190fe054e0b3c93495f2243fd652ebd423adb8377c7" asset_name="talosctl-linux-amd64" release_base="https://github.com/siderolabs/talos/releases/download/v${TALOS_VERSION}" From 72314bf11db795cc2856a0d2ac9d5a835e0b3fbd Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 23 Sep 2026 18:36:11 +0200 Subject: [PATCH 3/3] fix(talos): align AppArmor LSM order with v1.14.0 --- scripts/tests/test-talos-apparmor-lsm.sh | 4 ++-- talos/cluster/enable-apparmor.yaml | 4 ++-- talos/factory-schematic.yaml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/scripts/tests/test-talos-apparmor-lsm.sh b/scripts/tests/test-talos-apparmor-lsm.sh index 48f25915ef..7b440a33ee 100755 --- a/scripts/tests/test-talos-apparmor-lsm.sh +++ b/scripts/tests/test-talos-apparmor-lsm.sh @@ -5,8 +5,8 @@ root_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd) config="$root_dir/talos/cluster/enable-apparmor.yaml" cluster_config="$root_dir/ksail.prod.yaml" ci_workflow="$root_dir/.github/workflows/ci.yaml" -expected_talos_version='v1.13.9' -expected='lsm=yama,selinux,loadpin,safesetid,integrity,bpf,apparmor,lockdown,landlock' +expected_talos_version='v1.14.0' +expected='lsm=yama,selinux,safesetid,integrity,bpf,apparmor,lockdown,landlock' if ! grep -Fq "'scripts/tests/test-talos-apparmor-lsm.sh'" "$ci_workflow" || ! grep -Fq 'bash scripts/tests/test-talos-apparmor-lsm.sh' "$ci_workflow"; then diff --git a/talos/cluster/enable-apparmor.yaml b/talos/cluster/enable-apparmor.yaml index 65f97f4cee..e17330024e 100644 --- a/talos/cluster/enable-apparmor.yaml +++ b/talos/cluster/enable-apparmor.yaml @@ -1,13 +1,13 @@ machine: install: extraKernelArgs: - # Preserve Talos v1.13.9's complete upstream CONFIG_LSM order while + # Preserve Talos v1.14.0's complete upstream CONFIG_LSM order while # explicitly enabling AppArmor. Linux 6.18 no longer reliably supplies an audit # subject context when the legacy security=apparmor selector is used; # every affected audit record then emits # "audit: error in audit_log_subj_ctx". An explicit lsm= list keeps the # other compiled hardening modules active and restores that context. - - lsm=yama,selinux,loadpin,safesetid,integrity,bpf,apparmor,lockdown,landlock + - lsm=yama,selinux,safesetid,integrity,bpf,apparmor,lockdown,landlock # KSail folds this native Talos declaration into the Image Factory # schematic, clears the deprecated rendered extraKernelArgs field, and pins # grubUseUKICmdline=true so the baked-in arguments take effect. The canonical diff --git a/talos/factory-schematic.yaml b/talos/factory-schematic.yaml index 85f547c8e4..880adf2163 100644 --- a/talos/factory-schematic.yaml +++ b/talos/factory-schematic.yaml @@ -1,6 +1,6 @@ customization: extraKernelArgs: - - lsm=yama,selinux,loadpin,safesetid,integrity,bpf,apparmor,lockdown,landlock + - lsm=yama,selinux,safesetid,integrity,bpf,apparmor,lockdown,landlock systemExtensions: officialExtensions: - siderolabs/iscsi-tools