LoginSign Up
← Back to all sparks
T

Talos Linux

INFRA · APIS
Velocity7.5

Immutable API-managed Linux distribution for Kubernetes

www.talos.dev ↗

Talos Linux is shipping native BGP, DNS-over-TLS, and VXLAN—turning from a Kubernetes OS into a full network fabric.

kubernetesinfrastructurenetworkingbgpself-hostedlinux
◆Current state
Talos is in an active feature expansion phase across multiple stable branches simultaneously. The 1.14.x release cycle introduced embedded GoBGP (no FRR extension needed), DNS over TLS/HTTPS, btrfs support, MACVLAN and VXLAN link types, EtcFileConfig management, and moved etcd to v3.7—a substantial capability surface addition. Stable branches (1.12, 1.13) are receiving security hardening: kubelet certificate handling, API proxy metadata filtering, tar extraction fixes.
◆Where it's heading
The 1.15 alpha already shows continued networking investment: containerd config format bump to version 4, KubeSpan peer-endpoint filtering (nodes can now exclude unreachable peer addresses), MACVLAN link support, and a new `diskfree` command for storage observability. The pattern across 1.14 and 1.15 is clear: Talos is pulling cluster networking capability in-process rather than delegating to system extensions.
◆Prediction
The 1.14 stable release is the likely next milestone, formalizing the BGP/DoT/VXLAN stack as production-ready. The 1.15 alpha's containerd v4 config migration is a breaking change for customized CRI configs that will require operator attention.

◆Recent moves

  1. 8d ago

    Talos v1.15 alpha: containerd v4 config, VXLAN/MACVLAN, KubeSpan filtering

    ⚡ SPARK

    The 1.15 alpha opens a new development cycle with containerd configuration format v4 (breaking for customized CRI configs), MACVLAN and VXLAN link support, KubeSpan peer endpoint filtering, a unified `--namespace` flag across CLI tools, and a new `talosctl diskfree` command—continuing the 1.14 networking build-out into the next major cycle.

    View source ↗
  2. 12d ago

    v1.12.12

    v1.12.12 is a security maintenance release: kubelet client certificate handling hardening, API proxying metadata filtering, tar extraction safety fixes (parent directory creation, xattr handling, os.Root path isolation), and component bumps to Kubernetes 1.35.8, etcd 3.6.14, and Linux 6.18.49.

    View source ↗
  3. 12d ago

    v1.13.10

    v1.13.10 delivers 28 commits of security hardening and stability fixes: kubelet certificate hardening, kubeconfig validation, CSI volume SELinux context fix, etcd snapshot atomicity, route creation churn fix (every 100ms), and CoreDNS updated to 1.14.7. This branch is getting serious production reliability attention.

    View source ↗
  4. 22d ago

    Talos v1.14.0-rc.2: BGP instances, DNS-over-TLS, etcd port split

    ⚡ SPARK

    v1.14.0-rc.2 refines the BGP implementation from beta: `BGPInstanceConfig` replaces `BGPPeerConfig`, supporting named instances, optional Linux VRF, BFD, ECMP, and cross-instance route imports. The RC also adds DNS over TLS/HTTPS per nameserver, btrfs volume support, etcd HTTP/gRPC port split (2379/2383), and EtcFileConfig for managing files under /etc without restarts.

    View source ↗
  5. 1mo ago

    v1.14.0-rc.1

    v1.14.0-rc.1 is the first public preview of the 1.14 feature set—native BGP (then called BGPPeerConfig), DNS-over-TLS, btrfs, CRIBaseRuntimeSpecConfig, CRICustomizationConfig, EtcFileConfig, noexec on /var, and cluster discovery multi-endpoint support. The RC.2 refined the BGP API but this release established the feature surface.

    View source ↗
  6. 1mo ago

    v1.12.11

    v1.12.11 patches memory management and race conditions: OOM protection for pod runtime, volume mount race (third attempt), trailing rate-limited trigger preservation, and PCR extension timing fix. Linux kernel bumped to 6.18.42.

    View source ↗