LoginSign Up
← Back to all sparks
T

Talos Linux

INFRA · APIS
Velocity5.0

Immutable API-managed Linux distribution for Kubernetes

www.talos.dev ↗

Talos 1.15 reaches beta with per-link packet filtering and BGP session passwords.

kubernetesdeclarative-confignetworkingbgpcontainerdself-hosted
◆Current state
Talos 1.15.0-beta.0 landed on 10 November, closing the alpha cycle that brought containerd configuration v4, CPU scaling documents and container swap limits. The beta adds NetworkLinkIngressConfig, which drops incoming packets not addressed to chosen IPs on a link, and MD5 authentication for BGP sessions, with the password redacted from config output. Stable branches still receive separate maintenance releases.
◆Where it's heading
Each 1.15 pre-release pushes more host networking and resource control into typed, declarative config documents, building on the native BGP work from 1.14. The new ingress filter ships with an explicit list of setups it breaks, such as Cilium kube-proxy replacement and MetalLB, which signals that these features target operators running bare-metal fabrics.
◆Prediction
Release candidates for 1.15 are the next step, most likely with fixes to the new network documents rather than further features.

◆Recent moves

  1. 3d ago

    v1.15 beta.0: per-link ingress filtering, BGP MD5 auth

    The first 1.15 beta adds a per-link filter for incoming packets by destination IP and MD5 passwords for BGP neighbors. It extends the 1.14 BGP work and the alpha's typed config documents, and it lists the load-balancer and CNI setups the filter breaks.

    View source ↗
  2. 17d ago

    v1.15 alpha.2: CPU scaling, swap limits, containerd v4 caveats

    The second 1.15 alpha adds typed CPU scaling, container swap limits and safer boot partition detection. It also carries forward the containerd v4 change, which silently ignores moved settings in custom CRI configs.

    View source ↗
  3. 23d ago

    v1.13.12: DHCP fix, QEMU GSO workaround, kernel and containerd

    Maintenance on the 1.13 branch: Linux 6.18.57, containerd 2.2.10, a DHCP address-change fix and GSO offload disabled on QEMU 10.2 and later. Stable branches keep moving independently of the alpha.

    View source ↗
  4. 2mo ago

    Talos v1.15 alpha: containerd v4, VXLAN/MACVLAN, KubeSpan filtering

    ⚡ SPARK

    The 1.15 alpha opens a new development cycle with containerd configuration format v4 (breaking for customized CRI configs), MACVLAN and VXLAN link support, KubeSpan peer endpoint filtering, a unified `--namespace` flag across CLI tools, and a new `talosctl diskfree` command—continuing the 1.14 networking build-out into the next major cycle.

    View source ↗
  5. 2mo ago

    v1.12.12

    v1.12.12 is a security maintenance release: kubelet client certificate handling hardening, API proxying metadata filtering, tar extraction safety fixes (parent directory creation, xattr handling, os.Root path isolation), and component bumps to Kubernetes 1.35.8, etcd 3.6.14, and Linux 6.18.49.

    View source ↗
  6. 2mo ago

    v1.13.10

    v1.13.10 delivers 28 commits of security hardening and stability fixes: kubelet certificate hardening, kubeconfig validation, CSI volume SELinux context fix, etcd snapshot atomicity, route creation churn fix (every 100ms), and CoreDNS updated to 1.14.7. This branch is getting serious production reliability attention.

    View source ↗