LoginSign Up
← Back to all sparks
T

Talos Linux

INFRA · APIS
Velocity6.3

Immutable API-managed Linux distribution for Kubernetes

www.talos.dev ↗

Talos 1.14 brings BGP routing into the OS and locks /var down to noexec by default.

kubernetes-osbgpencrypted-dnshardeningdeclarative-configbeta-releases
◆Current state
The 1.14 line is in beta, with beta.0 and beta.1 a week apart carrying identical cumulative notes, while 1.12.10 continues as the maintenance stream with kernel bumps and small fixes. The 1.14 changes are unusually load-bearing for a minor: native BGP routing via embedded GoBGP configured through BGPInstanceConfig documents, DNS over TLS and DNS over HTTPS configurable per name server, and the EPHEMERAL volume at /var defaulting to noexec alongside the existing nosuid and nodev. The release notes name Longhorn v1 and vCluster as workloads that break under the new mount defaults and document the opt-out.
◆Where it's heading
Talos keeps absorbing infrastructure that used to require system extensions or sidecars — BGP was previously an FRR extension, DNS privacy was the resolver's problem, and both are now machine-configuration documents. The security posture is tightening in the same motion: noexec by default on new machines, encrypted DNS, and the removal of `--mode=reboot` from apply-config so the reboot-free path is the norm. That is a consistent read of Talos as a declarative appliance where capability arrives as config schema, not packages.
◆Prediction
Expect 1.14 to reach stable with the noexec default intact and the opt-out documented rather than softened, and the BGP surface to grow additional neighbor and policy options once operators run it against real fabrics.

◆Recent moves

  1. 3d ago

    v1.14.0-beta.1

    The second 1.14 beta, a week after the first and carrying the same cumulative release notes — native BGP, encrypted DNS, the noexec default. Iteration inside the beta cycle; the substance is classified on beta.0 where it first appeared.

    View source ↗
  2. 11d ago

    v1.14.0-beta.0

    ⚡ SPARK

    The first 1.14 beta, and where the release's real content appears: BGP routing running natively on the host, per-name-server DoT and DoH, /var defaulting to noexec, and apply-config losing its reboot mode. It is the clearest step yet in Talos absorbing infrastructure that used to need extensions, and the first of these betas to state the breaking mount default.

    View source ↗
  3. 18d ago

    v1.12.10

    An eight-commit maintenance release on the 1.12 line: a kernel bump to 6.18.38, the ifb kernel module added, a QoS trigger cooldown and a kubelet restart fix. Routine upkeep while 1.14 is in beta.

    View source ↗