[talos] Update Talos Linux v1.10.5 - #1186
Conversation
|
Caution Review failedThe pull request is closed. WalkthroughThis change updates the Talos Linux installer profile YAML files across multiple profiles, incrementing their version from v1.10.3 to v1.10.5. All system extension image references—including firmware, microcode, DRBD, and ZFS—are updated to newer versions or more recent date-based tags. No structural or configuration logic changes are made. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant TalosInstaller
participant Registry
User->>TalosInstaller: Deploy with profile (v1.10.5)
TalosInstaller->>Registry: Pull baseInstaller:v1.10.5
TalosInstaller->>Registry: Pull updated firmware/microcode images (202507xx)
TalosInstaller->>Registry: Pull drbd:9.2.14-v1.10.5
TalosInstaller->>Registry: Pull zfs:2.3.3-v1.10.5
TalosInstaller-->>User: Complete installation with updated components
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (7)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
packages/core/installer/images/talos/profiles/iso.yaml (1)
6-14: Base installer is still on v1.10.3 → very likely a mismatch with the profile version bumpThe profile explicitly advertises
version: v1.10.5, yet thebaseInstaller.imageRefremains pinned tov1.10.3. Deployments will therefore mix a newer profile with an older installer binary, which is a frequent source of subtle breakage (extension-API drift, unsupported kernel params, etc.).If
v1.10.5is the target release, keep all Talos artefacts on the same minor/patch version to guarantee compatibility.- imageRef: "ghcr.io/siderolabs/installer:v1.10.3" + imageRef: "ghcr.io/siderolabs/installer:v1.10.5"
🧹 Nitpick comments (4)
packages/core/installer/images/talos/profiles/iso.yaml (1)
15-21: Tag-only references: consider pinning digests for reproducibilityAll updated
systemExtensionsuse floating date / patch tags (20250708,v1.10.5, etc.).
For long-term reproducibility (and to avoid unexpected image mutations), pin each reference to an immutable digest (@sha256:…).This is optional for day-to-day CI but highly recommended for release branches or downstream artefact builders.
packages/core/installer/images/talos/profiles/nocloud.yaml (1)
15-21: Pin system-extension images by digest (and verify mixed microcode dates)
All extension tags are mutable (e.g.,
20250708). For fully reproducible builds, consider pinning by digest (@sha256:…) instead of tags to avoid unexpected drift.Most firmware images were updated to
20250708, yetintel-ucoderemains at20250512. Confirm this is deliberate and not an accidental omission.These are low-risk but worthwhile hygiene tweaks for long-term determinism.
packages/core/installer/images/talos/profiles/metal.yaml (1)
15-21: Pin images by digest for reproducible buildsAll new system-extension references are mutable tags (date-based or semver). To guarantee bit-for-bit reproducibility and prevent supply-chain surprises, consider switching to digest-pinned refs, e.g.:
- imageRef: ghcr.io/siderolabs/amd-ucode:20250708 + imageRef: ghcr.io/siderolabs/amd-ucode@sha256:<digest>The same applies to the remaining entries.
packages/core/installer/images/talos/profiles/installer.yaml (1)
15-21: Confirm digest-pinning & consistency of firmware dates
All firmware/system-extension tags were rolled forward, but:
intel-ucodelags at20250512while others moved to20250708– check if a newer microcode blob exists to keep the set in lock-step.- Tags alone are mutable. For reproducible builds, consider pinning by digest (
sha256:…) rather than date/semantic tags.No functional blocker, but tightening these helps long-term traceability.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
packages/core/installer/images/talos/profiles/initramfs.yaml(2 hunks)packages/core/installer/images/talos/profiles/installer.yaml(2 hunks)packages/core/installer/images/talos/profiles/iso.yaml(2 hunks)packages/core/installer/images/talos/profiles/kernel.yaml(2 hunks)packages/core/installer/images/talos/profiles/metal.yaml(2 hunks)packages/core/installer/images/talos/profiles/nocloud.yaml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (6)
packages/core/installer/images/talos/profiles/nocloud.yaml (1)
6-14: Version bump to v1.10.5 whilebaseInstaller.imageRefremains on v1.10.3The profile declares
version: v1.10.5, but thebaseInstallerstill pullsghcr.io/siderolabs/installer:v1.10.3.
If the v1.10.5 release contains critical fixes, security patches, or schema changes, shipping an older installer container could lead to subtle incompatibilities at install time.Please double-check whether this mismatch is intentional and, if not, update the image reference:
- imageRef: "ghcr.io/siderolabs/installer:v1.10.3" + imageRef: "ghcr.io/siderolabs/installer:v1.10.5"packages/core/installer/images/talos/profiles/kernel.yaml (2)
12-13: Base installer tag is stillv1.10.3while profile isv1.10.5– double-check this isn’t an oversight.
If theinstaller:v1.10.5image exists, it should probably be referenced here for consistency; if it doesn’t, please confirm that mixing versions is expected and supported by Talos.
15-21: Validate that every new system-extension image tag has been pushed and is pullable.
A quick pre-merge pull test (or CI job) will avoid runtime failures when the profile is consumed.packages/core/installer/images/talos/profiles/metal.yaml (1)
6-14: Version skew betweenversionfield andbaseInstallertagProfile advertises Talos
v1.10.5, but thebaseInstallerimage is still pinned tov1.10.3. If this is unintentional it can cause subtle breakage (extension ABI drift, installer CLI flag mismatch, etc.).
Please double-check upstream release notes and either bump the installer tag tov1.10.5or add an explicit comment explaining why the older installer must be kept.packages/core/installer/images/talos/profiles/initramfs.yaml (2)
15-21: Mixed-dated system-extension tags – double-check Intel ucode lagAll extensions were refreshed to the 2025-07-08 build except
intel-ucode, which stayed on2025-05-12.
If a newer microcode bundle exists, bumping it keeps the fleet homogeneous; otherwise a short comment noting the gap would prevent future confusion.
6-15: Verify Talos profilebaseInstallerversion alignmentAll Talos profiles currently pin the
baseInstallerimage toghcr.io/siderolabs/installer:v1.10.3, whileinitramfs.yaml(and presumably others) declareversion: v1.10.5:
- packages/core/installer/images/talos/profiles/nocloud.yaml: imageRef: installer:v1.10.3
- packages/core/installer/images/talos/profiles/kernel.yaml: imageRef: installer:v1.10.3
- packages/core/installer/images/talos/profiles/metal.yaml: imageRef: installer:v1.10.3
- packages/core/installer/images/talos/profiles/iso.yaml: imageRef: installer:v1.10.3
- packages/core/installer/images/talos/profiles/installer.yaml: imageRef: installer:v1.10.3
- packages/core/installer/images/talos/profiles/initramfs.yaml: imageRef: installer:v1.10.3
Please confirm whether this discrepancy is intentional (e.g., compatibility constraints noted in release notes or upstream changelog) or update each
imageReftoinstaller:v1.10.5to match the declaredversion.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
7e6e7a7 to
aa84b1c
Compare
Signed-off-by: Andrei Kvapil kvapss@gmail.com
What this PR does
Release note
Summary by CodeRabbit