Release Notes

Management runs as one container containing the browser application, backend, Git service and administrative tools. The nested Kubernetes runtime is removed. The container uses a read-only root filesystem, persistent storage at /var, and temporary filesystems for runtime data.

Release and update bundles require an exact Management version and build ID. Installation, recovery and update check that the matching build is active.

On supported ISO hosts, when a selected bundle requires a newer Management build, Management can prepare its replacement before the appliance operation. Acquiring a bundle alone does not restart Management. Finish active operations and bundle transfers before replacement, then sign in again and restore temporary cluster access.

The Management ISO can retain a selected bundle image across reboots and ISO replacement. A failed startup does not automatically roll back the image selection.

Each target release has one update bundle, with a declared minimum source version.

Appliance installation requires signed release media, UEFI Secure Boot and a persistent TPM 2.0 on every node. Installation and update checks verify the required boot security state. Conversion of existing unsecured appliance installations and signing-key rotation are unsupported.

Talos system state, ephemeral storage, and the dedicated Database and Data volumes use LUKS2 encryption with TPM-protected keys. Preserve each node’s TPM and firmware state with its installed disks. Recovery onto replacement hardware uses the protected recovery set and enrolls the destination’s own TPM. These controls apply to appliance nodes; the Management ISO state disk remains unencrypted.

Zot and hypervisor guest agents run as Talos container services instead of system extensions.

Restricted Pod Security admission applies to ordinary appliance workloads. Infrastructure exceptions have explicit admission controls, and local storage provisioning restricts privileged helper pods. Workloads receive narrower privileges, service-account access and writable paths.

Cilium policies deny Pod traffic by default and allow the declared application, storage, monitoring and bootstrap connections. Node firewall rules restrict administrative and internal service access. Selected ERS services, Grafana and Alertmanager retain external connectivity for their integrations. Backup export and customer log export receive destination rules from their saved configuration.

Node telemetry uses authenticated TLS paths through Alloy. API-server connections to kubelets explicitly validate the kubelet server certificate. Cilium WireGuard protects supported cross-node Pod traffic; these controls do not encrypt every node-network connection.

Appliance-node Zot HTTPS moves from TCP 443 to TCP 5443. Installation, HSM library publication and temporary API-lease capture use the new port. Backup capture also understands the Talos 1.14 network configuration format.

SSH defaults to disabled, with no factory host password.

Host access in the console configures passwords, public keys, authentication method and SSH enablement during setup, normal operation and recovery.

Access configured before initialization expires at reboot. Access configured after initialization persists across reboots and ISO updates.

Unattended Management initialization can explicitly enable SSH and stage a separate host password or public keys from protected files. Supplying keys alone does not enable SSH.

Host-access state conversion closes SSH and removes the old host password while preserving host identity, host keys and saved public keys. Have console access before replacing predecessor media, and explicitly configure and enable SSH if needed. This conversion does not establish compatibility with predecessor Management application state.

Disk admission accepts an 80 GiB OS disk, 10 GiB Database disk and 10 GiB Data disk per appliance node, with a 50 GiB Management state disk. Recommended appliance sizing remains 8 vCPUs, 32 GiB RAM and 135/200/500 GiB disks. Minimum capacity does not establish a workload or retention guarantee. See Hardware requirements.

Management state initialization tests sequential read/write and mixed random I/O after destructive confirmation. Results below 40 MiB/s for either sequential direction, below 50 aggregate 4 KiB mixed IOPS, or unavailable measurements require explicit acceptance of unsupported performance. Rejecting the result does not restore data overwritten by the test.

The VMware Metal OVA supplies the recommended CPU, memory and three-disk layout. Its populated system disk is the OS installation target; Database and Data disks are blank. Signed OVA deployment requires vCenter, a key provider and a fresh vTPM.

Installation reuses a verified installed Talos disk boot where possible and wipes the confirmed data disks before provisioning their encrypted volumes. Failed and cancelled installation attempts retain early diagnostic snapshots across retries, including failures before a final artifact bundle exists. Snapshots expire after six hours by default or when Management restarts; download them promptly.

The browser terminal is embedded in Management with explicit session controls. Closing a session or leaving its page ends that tab’s root shell; other terminal sessions remain independent.

Container deployments can change the Management hostname after initialization while retaining the Git user, repositories and automation identity. Hostname inputs are normalized, and proxy Host forwarding to Headlamp is corrected.

ERS setup validates CA lifetimes before submission. Garage initialization uses a dedicated packaged Python runtime rather than monitoring-sidecar tools. Bundle downloads retain a known total size when later progress events omit it. Update completion waits for the published configuration and observed Kubernetes convergence.

From 1.0.2, the update replaces the ERS chart with 3.0.0-rc.2. It performs no HSM conversion or platform upgrade.

From 1.0.1, the update includes the changed ERS workload images and converts generated software, Utimaco and Securosys HSM settings to the ERS Helm 3 format. It preserves uploaded HSM image identities, credentials and unrelated operator settings. Custom HSM mounts or environment settings require review; historical generic library images are unsupported. Talos Linux and Kubernetes are unchanged from 1.0.1.

Bundle uploads can run concurrently without disabling unrelated bundle actions. Each upload retains its own progress and cancellation controls.

Failed archive uploads display a request ID when the server supplies one, so the failure can be matched to diagnostics.

Management detects the previous ERS HSM configuration format and directs the operator to complete the appliance update before editing ERS settings.

Flux installs and maintains Kubernetes add-ons after networking and DNS bootstrap, including storage, certificate management and gateway components. Operator charts wait for their selected CRDs before advancing.

Database and namespace reconciliation retains state during ordinary GitOps removal. This does not protect against privileged direct deletion or replace backups.

Gateway rollouts create a replacement before removing the existing local endpoint.

Prometheus uses process signals to reload configuration and has a 120-second shutdown grace period.

A separate Management VM boots from the Management ISO and keeps host and Management state on its dedicated disk.

Management also runs with Docker or Docker Compose on an operator workstation or an operator-created Linux VM. Operators supply and maintain the host, container runtime, networking, TLS and persistent storage.

Management installs the Appliance from supplied release content and provides configuration, reconnection, ERS setup, HSM library administration, monitoring access and diagnostics.

Appliance backup configuration, completed-backup downloads, external publication and full recovery have dedicated operator workflows.

Release, update, artifact, backup, recovery and diagnostics bundles have distinct purposes and retention requirements.

The Management ISO remains attached and boots the host on every start. The state disk does not contain an installed host operating system.

The ISO provides no rollback workflow, Management password reset, or Management state-disk restore tool. Reconstruct Management for a surviving Appliance with retained artifacts.

Full backups exclude metrics history, log history and Grafana’s local database and UI-created state. External HSM keys need separate protection.

Saving and publishing configuration do not confirm that workloads are healthy. Verify the affected service after changes.

Diagnostics retains only the latest temporary result. Download it before another collection or Management restart.

This manual does not define an individual-node replacement procedure. Contact support for that failure scenario.