chore: rekres, bump deps, Go, Talos and k8s versions, satisfy linters

- Bump some deps, namely cosi-runtime and Talos machinery.
- Update `auditState` to implement the new methods in COSI's `state.State`.
- Bump default Talos and Kubernetes versions to their latest.
- Rekres, which brings Go 1.24.5. Also update it in go.mod files.
- Fix linter errors coming from new linters.

Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>

.github/workflows/ci.yaml

@@ -1,8 +1,7 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-20T12:53:11Z by kres 5128bc1.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: default
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -17,6 +16,7 @@ concurrency:
     branches:
       - main
       - release-*
+name: default
 jobs:
   default:
     permissions:

.github/workflows/e2e-backups-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-09T15:23:59Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-backups-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-backups-cron
 jobs:
   default:
     runs-on:

.github/workflows/e2e-forced-removal-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-09T15:23:59Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-forced-removal-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-forced-removal-cron
 jobs:
   default:
     runs-on:

.github/workflows/e2e-omni-upgrade-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-20T12:53:11Z by kres 5128bc1.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-omni-upgrade-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-omni-upgrade-cron
 jobs:
   default:
     runs-on:

.github/workflows/e2e-scaling-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-09T15:23:59Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-scaling-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-scaling-cron
 jobs:
   default:
     runs-on:

.github/workflows/e2e-short-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-09T15:23:59Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-short-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-short-cron
 jobs:
   default:
     runs-on:

.github/workflows/e2e-short-secureboot-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-09T15:23:59Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-short-secureboot-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-short-secureboot-cron
 jobs:
   default:
     runs-on:

.github/workflows/e2e-templates-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-09T15:23:59Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-templates-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-templates-cron
 jobs:
   default:
     runs-on:

.github/workflows/e2e-upgrades-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-09T15:23:59Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-upgrades-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-upgrades-cron
 jobs:
   default:
     runs-on:

.github/workflows/e2e-workload-proxy-cron.yaml

@@ -1,14 +1,14 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-09T15:23:59Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: e2e-workload-proxy-cron
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 "on":
   schedule:
     - cron: 30 1 * * *
+name: e2e-workload-proxy-cron
 jobs:
   default:
     runs-on:

.github/workflows/helm.yaml

@@ -1,8 +1,7 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-06T17:20:38Z by kres fc6afbe-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: helm
 concurrency:
   group: helm-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -16,6 +15,7 @@ concurrency:
       - release-*
     paths:
       - deploy/helm/**
+name: helm
 jobs:
   default:
     permissions:

.github/workflows/lock.yml

@@ -1,11 +1,11 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-11T10:19:52Z by kres 5128bc1.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: Lock old issues
 "on":
   schedule:
     - cron: 0 2 * * *
+name: Lock old issues
 permissions:
   issues: write
 jobs:

.github/workflows/slack-notify.yaml

@@ -1,8 +1,7 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-20T12:04:15Z by kres 5128bc1.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: slack-notify
 "on":
   workflow_run:
     workflows:
@@ -18,6 +17,7 @@ name: slack-notify
       - e2e-omni-upgrade-cron
     types:
       - completed
+name: slack-notify
 jobs:
   slack-notify:
     runs-on:

.github/workflows/stale.yml

@@ -1,11 +1,11 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-11T10:19:52Z by kres 5128bc1.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
-name: Close stale issues and PRs
 "on":
   schedule:
     - cron: 30 1 * * *
+name: Close stale issues and PRs
 permissions:
   issues: write
   pull-requests: write

.golangci.yml

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-05-30T19:29:08Z by kres 9f64b0d-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
 version: "2"
 
@@ -49,6 +49,9 @@ linters:
     - perfsprint # complains about us using fmt.Sprintf in non-performance critical code, updating just kres took too long
     - musttag # seems to be broken - goes into imported libraries and reports issues there
     - nolintlint # gives false positives - disable until https://github.com/golangci/golangci-lint/issues/3228 is resolved
+    - wsl # replaced by wsl_v5
+    - noinlineerr
+    - embeddedstructfieldcheck # fighting in many places with fieldalignment
   # all available settings of specific linters
   settings:
     cyclop:
@@ -90,6 +93,10 @@ linters:
       simple: true
       range-loops: true # Report preallocation suggestions on range loops, true by default
       for-loops: false # Report preallocation suggestions on for loops, false by default
+    revive:
+      rules:
+        - name: var-naming # Complains about package names like "common"
+          disabled: true
     rowserrcheck: { }
     testpackage: { }
     unparam:

Dockerfile

@@ -1,8 +1,8 @@
-# syntax = docker/dockerfile-upstream:1.16.0-labs
+# syntax = docker/dockerfile-upstream:1.17.1-labs
 
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-07-09T11:15:01Z by kres 1700045.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
 ARG JS_TOOLCHAIN
 ARG TOOLCHAIN
@@ -20,7 +20,7 @@ ENV GOPATH=/go
 ENV PATH=${PATH}:/usr/local/go/bin
 
 # runs markdownlint
-FROM docker.io/oven/bun:1.2.15-alpine AS lint-markdown
+FROM docker.io/oven/bun:1.2.18-alpine AS lint-markdown
 WORKDIR /src
 RUN bun i markdownlint-cli@0.45.0 sentences-per-line@0.3.0
 COPY .markdownlint.json .

Makefile

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-11T18:28:11Z by kres 37c4809-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
 # common variables
 
@@ -22,14 +22,14 @@ TESTPKGS ?= ./...
 JS_BUILD_ARGS ?=
 PROTOBUF_GO_VERSION ?= 1.36.6
 GRPC_GO_VERSION ?= 1.5.1
-GRPC_GATEWAY_VERSION ?= 2.26.3
+GRPC_GATEWAY_VERSION ?= 2.27.1
 VTPROTOBUF_VERSION ?= 0.6.0
 GOIMPORTS_VERSION ?= 0.34.0
 GOMOCK_VERSION ?= 0.5.2
 DEEPCOPY_VERSION ?= v0.5.6
-GOLANGCILINT_VERSION ?= v2.1.6
+GOLANGCILINT_VERSION ?= v2.2.2
 GOFUMPT_VERSION ?= v0.8.0
-GO_VERSION ?= 1.24.4
+GO_VERSION ?= 1.24.5
 GO_BUILDFLAGS ?=
 GO_LDFLAGS ?=
 CGO_ENABLED ?= 0
@@ -79,7 +79,7 @@ COMMON_ARGS += --build-arg=DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)"
 COMMON_ARGS += --build-arg=GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
 COMMON_ARGS += --build-arg=GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
 COMMON_ARGS += --build-arg=TESTPKGS="$(TESTPKGS)"
-JS_TOOLCHAIN ?= docker.io/oven/bun:1.2.15-alpine
+JS_TOOLCHAIN ?= docker.io/oven/bun:1.2.18-alpine
 TOOLCHAIN ?= docker.io/golang:1.24-alpine
 
 # extra variables

client/.golangci.yml

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-05-30T19:29:08Z by kres 9f64b0d-dirty.
+# Generated on 2025-07-11T15:30:30Z by kres c691b83.
 
 version: "2"
 
@@ -49,6 +49,9 @@ linters:
     - perfsprint # complains about us using fmt.Sprintf in non-performance critical code, updating just kres took too long
     - musttag # seems to be broken - goes into imported libraries and reports issues there
     - nolintlint # gives false positives - disable until https://github.com/golangci/golangci-lint/issues/3228 is resolved
+    - wsl # replaced by wsl_v5
+    - noinlineerr
+    - embeddedstructfieldcheck # fighting in many places with fieldalignment
   # all available settings of specific linters
   settings:
     cyclop:
@@ -90,6 +93,10 @@ linters:
       simple: true
       range-loops: true # Report preallocation suggestions on range loops, true by default
       for-loops: false # Report preallocation suggestions on for loops, false by default
+    revive:
+      rules:
+        - name: var-naming # Complains about package names like "common"
+          disabled: true
     rowserrcheck: { }
     testpackage: { }
     unparam:

client/api/omni/management/management.pb.gw.go

@@ -44,6 +44,9 @@ func request_ManagementService_Kubeconfig_0(ctx context.Context, marshaler runti
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Kubeconfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -68,6 +71,9 @@ func request_ManagementService_Talosconfig_0(ctx context.Context, marshaler runt
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Talosconfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -92,6 +98,9 @@ func request_ManagementService_Omniconfig_0(ctx context.Context, marshaler runti
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Omniconfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -116,6 +125,9 @@ func request_ManagementService_MachineLogs_0(ctx context.Context, marshaler runt
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.MachineLogs(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -136,6 +148,9 @@ func request_ManagementService_ValidateConfig_0(ctx context.Context, marshaler r
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ValidateConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -160,6 +175,9 @@ func request_ManagementService_ValidateJSONSchema_0(ctx context.Context, marshal
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ValidateJSONSchema(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -184,6 +202,9 @@ func request_ManagementService_CreateServiceAccount_0(ctx context.Context, marsh
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CreateServiceAccount(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -208,6 +229,9 @@ func request_ManagementService_RenewServiceAccount_0(ctx context.Context, marsha
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.RenewServiceAccount(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -232,6 +256,9 @@ func request_ManagementService_ListServiceAccounts_0(ctx context.Context, marsha
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ListServiceAccounts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -256,6 +283,9 @@ func request_ManagementService_DestroyServiceAccount_0(ctx context.Context, mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DestroyServiceAccount(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -280,6 +310,9 @@ func request_ManagementService_KubernetesUpgradePreChecks_0(ctx context.Context,
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.KubernetesUpgradePreChecks(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -304,6 +337,9 @@ func request_ManagementService_KubernetesSyncManifests_0(ctx context.Context, ma
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.KubernetesSyncManifests(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -324,6 +360,9 @@ func request_ManagementService_CreateSchematic_0(ctx context.Context, marshaler
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CreateSchematic(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -348,6 +387,9 @@ func request_ManagementService_GetSupportBundle_0(ctx context.Context, marshaler
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.GetSupportBundle(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -368,6 +410,9 @@ func request_ManagementService_ReadAuditLog_0(ctx context.Context, marshaler run
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.ReadAuditLog(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -388,6 +433,9 @@ func request_ManagementService_MaintenanceUpgrade_0(ctx context.Context, marshal
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.MaintenanceUpgrade(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -412,6 +460,9 @@ func request_ManagementService_GetMachineJoinConfig_0(ctx context.Context, marsh
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GetMachineJoinConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }

client/api/omni/oidc/oidc.pb.gw.go

@@ -43,6 +43,9 @@ func request_OIDCService_Authenticate_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Authenticate(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }

client/api/omni/resources/resources.pb.gw.go

@@ -43,6 +43,9 @@ func request_ResourceService_Get_0(ctx context.Context, marshaler runtime.Marsha
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Get(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -67,6 +70,9 @@ func request_ResourceService_List_0(ctx context.Context, marshaler runtime.Marsh
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.List(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -91,6 +97,9 @@ func request_ResourceService_Create_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Create(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -115,6 +124,9 @@ func request_ResourceService_Update_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Update(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -139,6 +151,9 @@ func request_ResourceService_Delete_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Delete(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -163,6 +178,9 @@ func request_ResourceService_Teardown_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Teardown(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -187,6 +205,9 @@ func request_ResourceService_Watch_0(ctx context.Context, marshaler runtime.Mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.Watch(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err

client/api/talos/machine/machine.pb.gw.go

@@ -46,6 +46,9 @@ func request_MachineService_ApplyConfiguration_0(ctx context.Context, marshaler
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ApplyConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -70,6 +73,9 @@ func request_MachineService_Bootstrap_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Bootstrap(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -94,6 +100,9 @@ func request_MachineService_Containers_0(ctx context.Context, marshaler runtime.
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Containers(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -118,6 +127,9 @@ func request_MachineService_Copy_0(ctx context.Context, marshaler runtime.Marsha
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.Copy(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -138,6 +150,9 @@ func request_MachineService_CPUFreqStats_0(ctx context.Context, marshaler runtim
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CPUFreqStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -162,6 +177,9 @@ func request_MachineService_CPUInfo_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.CPUInfo(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -186,6 +204,9 @@ func request_MachineService_DiskStats_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.DiskStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -210,6 +231,9 @@ func request_MachineService_Dmesg_0(ctx context.Context, marshaler runtime.Marsh
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.Dmesg(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -230,6 +254,9 @@ func request_MachineService_Events_0(ctx context.Context, marshaler runtime.Mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.Events(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -250,6 +277,9 @@ func request_MachineService_EtcdMemberList_0(ctx context.Context, marshaler runt
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EtcdMemberList(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -274,6 +304,9 @@ func request_MachineService_EtcdRemoveMemberByID_0(ctx context.Context, marshale
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EtcdRemoveMemberByID(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -298,6 +331,9 @@ func request_MachineService_EtcdLeaveCluster_0(ctx context.Context, marshaler ru
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EtcdLeaveCluster(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -322,6 +358,9 @@ func request_MachineService_EtcdForfeitLeadership_0(ctx context.Context, marshal
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EtcdForfeitLeadership(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -387,6 +426,9 @@ func request_MachineService_EtcdSnapshot_0(ctx context.Context, marshaler runtim
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.EtcdSnapshot(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -407,6 +449,9 @@ func request_MachineService_EtcdAlarmList_0(ctx context.Context, marshaler runti
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EtcdAlarmList(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -431,6 +476,9 @@ func request_MachineService_EtcdAlarmDisarm_0(ctx context.Context, marshaler run
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EtcdAlarmDisarm(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -455,6 +503,9 @@ func request_MachineService_EtcdDefragment_0(ctx context.Context, marshaler runt
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EtcdDefragment(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -479,6 +530,9 @@ func request_MachineService_EtcdStatus_0(ctx context.Context, marshaler runtime.
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.EtcdStatus(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -503,6 +557,9 @@ func request_MachineService_GenerateConfiguration_0(ctx context.Context, marshal
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GenerateConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -527,6 +584,9 @@ func request_MachineService_Hostname_0(ctx context.Context, marshaler runtime.Ma
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Hostname(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -551,6 +611,9 @@ func request_MachineService_Kubeconfig_0(ctx context.Context, marshaler runtime.
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.Kubeconfig(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -571,6 +634,9 @@ func request_MachineService_List_0(ctx context.Context, marshaler runtime.Marsha
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.List(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -591,6 +657,9 @@ func request_MachineService_DiskUsage_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.DiskUsage(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -611,6 +680,9 @@ func request_MachineService_LoadAvg_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.LoadAvg(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -635,6 +707,9 @@ func request_MachineService_Logs_0(ctx context.Context, marshaler runtime.Marsha
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.Logs(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -655,6 +730,9 @@ func request_MachineService_LogsContainers_0(ctx context.Context, marshaler runt
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.LogsContainers(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -679,6 +757,9 @@ func request_MachineService_Memory_0(ctx context.Context, marshaler runtime.Mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Memory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -703,6 +784,9 @@ func request_MachineService_Mounts_0(ctx context.Context, marshaler runtime.Mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Mounts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -727,6 +811,9 @@ func request_MachineService_NetworkDeviceStats_0(ctx context.Context, marshaler
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.NetworkDeviceStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -751,6 +838,9 @@ func request_MachineService_Processes_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Processes(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -775,6 +865,9 @@ func request_MachineService_Read_0(ctx context.Context, marshaler runtime.Marsha
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.Read(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -795,6 +888,9 @@ func request_MachineService_Reboot_0(ctx context.Context, marshaler runtime.Mars
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Reboot(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -819,6 +915,9 @@ func request_MachineService_Restart_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Restart(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -843,6 +942,9 @@ func request_MachineService_Rollback_0(ctx context.Context, marshaler runtime.Ma
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Rollback(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -867,6 +969,9 @@ func request_MachineService_Reset_0(ctx context.Context, marshaler runtime.Marsh
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Reset(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -891,6 +996,9 @@ func request_MachineService_ServiceList_0(ctx context.Context, marshaler runtime
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ServiceList(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -915,6 +1023,9 @@ func request_MachineService_ServiceRestart_0(ctx context.Context, marshaler runt
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ServiceRestart(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -939,6 +1050,9 @@ func request_MachineService_ServiceStart_0(ctx context.Context, marshaler runtim
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ServiceStart(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -963,6 +1077,9 @@ func request_MachineService_ServiceStop_0(ctx context.Context, marshaler runtime
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ServiceStop(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -987,6 +1104,9 @@ func request_MachineService_Shutdown_0(ctx context.Context, marshaler runtime.Ma
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Shutdown(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1011,6 +1131,9 @@ func request_MachineService_Stats_0(ctx context.Context, marshaler runtime.Marsh
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Stats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1035,6 +1158,9 @@ func request_MachineService_SystemStat_0(ctx context.Context, marshaler runtime.
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.SystemStat(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1059,6 +1185,9 @@ func request_MachineService_Upgrade_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Upgrade(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1083,6 +1212,9 @@ func request_MachineService_Version_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Version(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1107,6 +1239,9 @@ func request_MachineService_GenerateClientConfiguration_0(ctx context.Context, m
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.GenerateClientConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1131,6 +1266,9 @@ func request_MachineService_PacketCapture_0(ctx context.Context, marshaler runti
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.PacketCapture(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -1151,6 +1289,9 @@ func request_MachineService_Netstat_0(ctx context.Context, marshaler runtime.Mar
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.Netstat(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1175,6 +1316,9 @@ func request_MachineService_MetaWrite_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.MetaWrite(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1199,6 +1343,9 @@ func request_MachineService_MetaDelete_0(ctx context.Context, marshaler runtime.
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.MetaDelete(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }
@@ -1223,6 +1370,9 @@ func request_MachineService_ImageList_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	stream, err := client.ImageList(ctx, &protoReq)
 	if err != nil {
 		return nil, metadata, err
@@ -1243,6 +1393,9 @@ func request_MachineService_ImagePull_0(ctx context.Context, marshaler runtime.M
 	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
 	msg, err := client.ImagePull(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err
 }

client/go.mod

@@ -1,6 +1,6 @@
 module github.com/siderolabs/omni/client
 
-go 1.24.4
+go 1.24.5
 
 replace (
 	// forked go-yaml that introduces RawYAML interface, which can be used to populate YAML fields using bytes
@@ -15,7 +15,7 @@ require (
 	github.com/adrg/xdg v0.5.3
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/blang/semver/v4 v4.0.0
-	github.com/cosi-project/runtime v0.10.5
+	github.com/cosi-project/runtime v0.10.6
 	github.com/dustin/go-humanize v1.0.1
 	github.com/fatih/color v1.18.0
 	github.com/gertd/go-pluralize v0.2.1
@@ -36,7 +36,7 @@ require (
 	github.com/siderolabs/image-factory v0.7.0
 	github.com/siderolabs/proto-codec v0.1.2
 	github.com/siderolabs/siderolink v0.3.15
-	github.com/siderolabs/talos/pkg/machinery v1.10.1
+	github.com/siderolabs/talos/pkg/machinery v1.10.5
 	github.com/spf13/cobra v1.9.1
 	github.com/stretchr/testify v1.10.0
 	github.com/xlab/treeprint v1.2.0
@@ -90,7 +90,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.5 // indirect
-	github.com/siderolabs/crypto v0.5.1 // indirect
+	github.com/siderolabs/crypto v0.6.0 // indirect
 	github.com/siderolabs/net v0.4.0 // indirect
 	github.com/siderolabs/protoenc v0.2.2 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect
@@ -109,8 +109,8 @@ require (
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard v0.0.0-20250505131008-436f7fdc1670 // indirect
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250512202823-5a2f75b736a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	k8s.io/apimachinery v0.34.0-alpha.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect

client/go.sum

@@ -26,8 +26,8 @@ github.com/containerd/go-cni v1.1.12 h1:wm/5VD/i255hjM4uIZjBRiEQ7y98W9ACy/mHeLi4
 github.com/containerd/go-cni v1.1.12/go.mod h1:+jaqRBdtW5faJxj2Qwg1Of7GsV66xcvnCx4mSJtUlxU=
 github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo=
 github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4=
-github.com/cosi-project/runtime v0.10.5 h1:iJwJJxB/7BvbGqBMGZHS8SDPaXY/igOBx5X5jwwgep8=
-github.com/cosi-project/runtime v0.10.5/go.mod h1:aK3oljZUJG6+ewkJRwY+VI9B40JmDp5++Ixri447TjE=
+github.com/cosi-project/runtime v0.10.6 h1:YEIm9XwxEqShKSFDVG+vhmtNm7IUGJhJSC/RriBI3yk=
+github.com/cosi-project/runtime v0.10.6/go.mod h1:TceKaCgUFF2+JLTFMtHvp12ARshvUeg34eY6TngkZa4=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -168,8 +168,8 @@ github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb
 github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
-github.com/siderolabs/crypto v0.5.1 h1:aZEUTZBoP8rH+0TqQAlUgazriPh89MrXf4R+th+m6ps=
-github.com/siderolabs/crypto v0.5.1/go.mod h1:7RHC7eUKBx6RLS2lDaNXrQ83zY9iPH/aQSTxk1I4/j4=
+github.com/siderolabs/crypto v0.6.0 h1:s33hNOneGhlxCI3fLKj2hgopeJkeRO7UYo3KL0HNVu4=
+github.com/siderolabs/crypto v0.6.0/go.mod h1:7RHC7eUKBx6RLS2lDaNXrQ83zY9iPH/aQSTxk1I4/j4=
 github.com/siderolabs/gen v0.8.4 h1:1Xj/YvKTXgpnr9ZC7heKcskJo5wHvWOybwjQSCfEmsQ=
 github.com/siderolabs/gen v0.8.4/go.mod h1:CRrktDXQf3yDJI7xKv+cDYhBbKdfd/YE16OpgcHoT9E=
 github.com/siderolabs/go-api-signature v0.3.6 h1:wDIsXbpl7Oa/FXvxB6uz4VL9INA9fmr3EbmjEZYFJrU=
@@ -190,8 +190,8 @@ github.com/siderolabs/protoenc v0.2.2 h1:vVQDrTjV+QSOiroWTca6h2Sn5XWYk7VSUPav5J0
 github.com/siderolabs/protoenc v0.2.2/go.mod h1:gtkHkjSCFEceXUHUzKDpnuvXu1mab9D3pVxTnQN+z+o=
 github.com/siderolabs/siderolink v0.3.15 h1:WSsgKQGJY/ObIKjTcYYGEaGfRMyox+r/Ft+9lIgJqOI=
 github.com/siderolabs/siderolink v0.3.15/go.mod h1:iWdlsHji90zotgDg4+a2zJL2ZMNJckQ8/VwqR39ThBM=
-github.com/siderolabs/talos/pkg/machinery v1.10.1 h1:iMG+I06ppz0Bj2Ex8NCSUBsbB6rK/gW9nCF01/TM2tU=
-github.com/siderolabs/talos/pkg/machinery v1.10.1/go.mod h1:MVJs1hsKm7N2GkQVeByjoDoLJmU/VhQO0cLJRZPxlZk=
+github.com/siderolabs/talos/pkg/machinery v1.10.5 h1:R0ZSf9OrHIQ70+LEpQVK/KVCq3E6sUi/OpIjLDVH3Sk=
+github.com/siderolabs/talos/pkg/machinery v1.10.5/go.mod h1:GxGnHH6gtX3J9s713+UbKvE9rLnlbYLv+Yn4rqD9Jh0=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
@@ -316,10 +316,10 @@ golang.zx2c4.com/wireguard v0.0.0-20250505131008-436f7fdc1670 h1:lvCs+t4iJfAyIbk
 golang.zx2c4.com/wireguard v0.0.0-20250505131008-436f7fdc1670/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 h1:vPV0tzlsK6EzEDHNNH5sa7Hs9bd7iXR7B1tSiPepkV0=
-google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:pKLAc5OolXC3ViWGI62vvC0n10CpwAtRcTNCFwTKBEw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250505200425-f936aa4a68b2 h1:IqsN8hx+lWLqlN+Sc3DoMy/watjofWiU8sRFgQ8fhKM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto/googleapis/api v0.0.0-20250512202823-5a2f75b736a9 h1:WvBuA5rjZx9SNIzgcU53OohgZy6lKSus++uY4xLaWKc=
+google.golang.org/genproto/googleapis/api v0.0.0-20250512202823-5a2f75b736a9/go.mod h1:W3S/3np0/dPWsWLi1h/UymYctGXaGBM2StwzD0y140U=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9 h1:IkAfh6J/yllPtpYFU0zZN1hUPYdT0ogkBT/9hMxHjvg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.72.0 h1:S7UkcVa60b5AAQTaO6ZKamFp1zMZSU0fGDK2WZLbBnM=
 google.golang.org/grpc v1.72.0/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=

client/pkg/client/example_test.go

@@ -88,6 +88,7 @@ func Example() {
 	if _, err = template.Sync(ctx, st); err != nil {
 		log.Panicf("failed to sync cluster %s", err)
 	}
+
 	if _, err = template.Sync(ctx, st); err != nil {
 		log.Panicf("failed to sync cluster %s", err)
 	}
@@ -98,6 +99,7 @@ func Example() {
 	if _, err = template.Delete(ctx, st); err != nil {
 		log.Panicf("failed to delete the cluster %s", err)
 	}
+
 	if _, err = template.Delete(ctx, st); err != nil {
 		log.Panicf("failed to delete the cluster %s", err)
 	}

client/pkg/constants/constants.go

@@ -14,7 +14,7 @@ const SecureBoot = "secureboot"
 // DefaultTalosVersion is pre-selected in the UI, default image and used in the integration tests.
 //
 // tsgen:DefaultTalosVersion
-const DefaultTalosVersion = "1.10.1"
+const DefaultTalosVersion = "1.10.5"
 
 const (
 	// TalosRegistry is the default Talos repository URL.

client/pkg/cosi/labels/lexer.go

@@ -166,7 +166,9 @@ func (l *lexer) read() (rune, int) {
 // scanIDOrKeyword scans string to recognize literal token (for example 'in') or an identifier.
 func (l *lexer) scanIDOrKeyword() (tok lexerToken, lit string) {
 	var buffer []rune
+
 IdentifierLoop:
+
 	for {
 		switch ch, width := l.read(); {
 		case ch == 0:

client/pkg/example_test.go

@@ -14,7 +14,6 @@ import (
 //nolint:wsl,testableexamples
 func Example() {
 	// This is an example of building omnictl executable.
-
 	version.Name = "omni"
 	version.SHA = "build SHA" // Optional.
 	version.Tag = "v0.29.0"   // Optional.

client/pkg/omni/resources/omni/cluster.go

@@ -180,7 +180,6 @@ func (validator ClusterValidator) validateEncryption() error {
 		version           semver.Version
 		err               error
 	)
-
 	if version, err = semver.ParseTolerant(validator.TalosVersion); err != nil {
 		return err
 	}

client/pkg/siderolink/siderolink_test.go

@@ -352,7 +352,6 @@ url: tcp://[fdae:41e4:649b:9303::1]:8092
 				var dest any
 
 				err = dec.Decode(&dest)
-
 				if errors.Is(err, io.EOF) {
 					break
 				}

client/pkg/template/internal/models/controlplane.go

@@ -48,7 +48,6 @@ func (controlplane *ControlPlane) Validate() error {
 	}
 
 	multiErr = joinErrors(multiErr, controlplane.MachineSet.Validate(), controlplane.Machines.Validate(), controlplane.Patches.Validate())
-
 	if multiErr != nil {
 		return fmt.Errorf("controlplane is invalid: %w", multiErr)
 	}

client/pkg/template/internal/models/machine.go

@@ -90,7 +90,6 @@ func (machine *Machine) Validate() error {
 	}
 
 	multiErr = joinErrors(multiErr, machine.Name.Validate(), machine.Install.Validate(), machine.Patches.Validate())
-
 	if multiErr != nil {
 		return fmt.Errorf("machine %q is invalid: %w", machine.Name, multiErr)
 	}

client/pkg/template/internal/models/workers.go

@@ -34,7 +34,6 @@ func (workers *Workers) Validate() error {
 	}
 
 	multiErr = joinErrors(multiErr, workers.MachineSet.Validate(), workers.Machines.Validate(), workers.Patches.Validate())
-
 	if multiErr != nil {
 		return fmt.Errorf("workers is invalid: %w", multiErr)
 	}

frontend/src/api/resources.ts

@@ -24,11 +24,11 @@ export const samlSessionHeader = "saml-session";
 export const SignedRedirect = "v1:";
 export const workloadProxyPublicKeyIdCookie = "publicKeyId";
 export const workloadProxyPublicKeyIdSignatureBase64Cookie = "publicKeyIdSignatureBase64";
-export const DefaultKubernetesVersion = "1.32.3";
+export const DefaultKubernetesVersion = "1.33.2";
 export const installDiskMinSize = 5e+09;
 export const authPublicKeyIDQueryParam = "public-key-id";
 export const SecureBoot = "secureboot";
-export const DefaultTalosVersion = "1.10.1";
+export const DefaultTalosVersion = "1.10.5";
 export const PatchWeightInstallDisk = 0;
 export const PatchBaseWeightCluster = 200;
 export const PatchBaseWeightMachineSet = 400;

go.mod

@@ -1,6 +1,6 @@
 module github.com/siderolabs/omni
 
-go 1.24.4
+go 1.24.5
 
 replace (
 	// forked saml library that has the fix for Fusion Auth ACS parsing
@@ -29,7 +29,7 @@ require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/cenkalti/backoff/v5 v5.0.2
 	github.com/containers/image/v5 v5.35.0
-	github.com/cosi-project/runtime v0.10.5
+	github.com/cosi-project/runtime v0.10.6
 	github.com/cosi-project/state-etcd v0.5.2
 	github.com/crewjam/saml v0.5.1
 	github.com/dustin/go-humanize v1.0.1
@@ -61,7 +61,7 @@ require (
 	github.com/prometheus/client_golang v1.22.0
 	github.com/prometheus/common v0.63.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1
-	github.com/siderolabs/crypto v0.5.1
+	github.com/siderolabs/crypto v0.6.0
 	github.com/siderolabs/discovery-api v0.1.6
 	github.com/siderolabs/discovery-client v0.1.11
 	github.com/siderolabs/discovery-service v1.0.10
@@ -82,7 +82,7 @@ require (
 	github.com/siderolabs/omni/client v0.49.0
 	github.com/siderolabs/proto-codec v0.1.2
 	github.com/siderolabs/siderolink v0.3.15
-	github.com/siderolabs/talos/pkg/machinery v1.10.1
+	github.com/siderolabs/talos/pkg/machinery v1.10.5
 	github.com/siderolabs/tcpproxy v0.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.9.1
@@ -260,8 +260,8 @@ require (
 	golang.org/x/term v0.32.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250512202823-5a2f75b736a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

go.sum

@@ -109,8 +109,8 @@ github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cosi-project/runtime v0.10.5 h1:iJwJJxB/7BvbGqBMGZHS8SDPaXY/igOBx5X5jwwgep8=
-github.com/cosi-project/runtime v0.10.5/go.mod h1:aK3oljZUJG6+ewkJRwY+VI9B40JmDp5++Ixri447TjE=
+github.com/cosi-project/runtime v0.10.6 h1:YEIm9XwxEqShKSFDVG+vhmtNm7IUGJhJSC/RriBI3yk=
+github.com/cosi-project/runtime v0.10.6/go.mod h1:TceKaCgUFF2+JLTFMtHvp12ARshvUeg34eY6TngkZa4=
 github.com/cosi-project/state-etcd v0.5.2 h1:hOQ07bGR2ZO9T7cuVS+ijYdNnIwTFH/c9BiazfGlXoc=
 github.com/cosi-project/state-etcd v0.5.2/go.mod h1:RY93aj/wPsq7C/UdLH1bq374PM10XqV3p4Dg2bRQN84=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -405,8 +405,8 @@ github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb
 github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
-github.com/siderolabs/crypto v0.5.1 h1:aZEUTZBoP8rH+0TqQAlUgazriPh89MrXf4R+th+m6ps=
-github.com/siderolabs/crypto v0.5.1/go.mod h1:7RHC7eUKBx6RLS2lDaNXrQ83zY9iPH/aQSTxk1I4/j4=
+github.com/siderolabs/crypto v0.6.0 h1:s33hNOneGhlxCI3fLKj2hgopeJkeRO7UYo3KL0HNVu4=
+github.com/siderolabs/crypto v0.6.0/go.mod h1:7RHC7eUKBx6RLS2lDaNXrQ83zY9iPH/aQSTxk1I4/j4=
 github.com/siderolabs/discovery-api v0.1.6 h1:/LhsF1ytqFEfWwV0UKfUgn90k9fk5+rhYMJ9yeUB2yc=
 github.com/siderolabs/discovery-api v0.1.6/go.mod h1:s5CnTyRMGid/vJNSJs8Jw9I4tnKHu/2SGqP2ytTaePQ=
 github.com/siderolabs/discovery-client v0.1.11 h1:Au+7QZ+CIB6g4C7ZCC4m5Ai5Uso1g/I3/E4bSUElzF8=
@@ -451,8 +451,8 @@ github.com/siderolabs/protoenc v0.2.2 h1:vVQDrTjV+QSOiroWTca6h2Sn5XWYk7VSUPav5J0
 github.com/siderolabs/protoenc v0.2.2/go.mod h1:gtkHkjSCFEceXUHUzKDpnuvXu1mab9D3pVxTnQN+z+o=
 github.com/siderolabs/siderolink v0.3.15 h1:WSsgKQGJY/ObIKjTcYYGEaGfRMyox+r/Ft+9lIgJqOI=
 github.com/siderolabs/siderolink v0.3.15/go.mod h1:iWdlsHji90zotgDg4+a2zJL2ZMNJckQ8/VwqR39ThBM=
-github.com/siderolabs/talos/pkg/machinery v1.10.1 h1:iMG+I06ppz0Bj2Ex8NCSUBsbB6rK/gW9nCF01/TM2tU=
-github.com/siderolabs/talos/pkg/machinery v1.10.1/go.mod h1:MVJs1hsKm7N2GkQVeByjoDoLJmU/VhQO0cLJRZPxlZk=
+github.com/siderolabs/talos/pkg/machinery v1.10.5 h1:R0ZSf9OrHIQ70+LEpQVK/KVCq3E6sUi/OpIjLDVH3Sk=
+github.com/siderolabs/talos/pkg/machinery v1.10.5/go.mod h1:GxGnHH6gtX3J9s713+UbKvE9rLnlbYLv+Yn4rqD9Jh0=
 github.com/siderolabs/tcpproxy v0.1.0 h1:IbkS9vRhjMOscc1US3M5P1RnsGKFgB6U5IzUk+4WkKA=
 github.com/siderolabs/tcpproxy v0.1.0/go.mod h1:onn6CPPj/w1UNqQ0U97oRPF0CqbrgEApYCw4P9IiCW8=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
@@ -694,10 +694,10 @@ google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 h1:1tXaIXCracvtsRxSBsYDiSBN0cuJvM7QYW+MrpIRY78=
 google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:49MsLSx0oWMOZqcpB3uL8ZOkAh1+TndpJ8ONoCBWiZk=
-google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 h1:vPV0tzlsK6EzEDHNNH5sa7Hs9bd7iXR7B1tSiPepkV0=
-google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:pKLAc5OolXC3ViWGI62vvC0n10CpwAtRcTNCFwTKBEw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250505200425-f936aa4a68b2 h1:IqsN8hx+lWLqlN+Sc3DoMy/watjofWiU8sRFgQ8fhKM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto/googleapis/api v0.0.0-20250512202823-5a2f75b736a9 h1:WvBuA5rjZx9SNIzgcU53OohgZy6lKSus++uY4xLaWKc=
+google.golang.org/genproto/googleapis/api v0.0.0-20250512202823-5a2f75b736a9/go.mod h1:W3S/3np0/dPWsWLi1h/UymYctGXaGBM2StwzD0y140U=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9 h1:IkAfh6J/yllPtpYFU0zZN1hUPYdT0ogkBT/9hMxHjvg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=

go.work

@@ -1,4 +1,4 @@
-go 1.24.4
+go 1.24.5
 
 use (
 	.

hack/generate-certs/main.go

@@ -55,7 +55,6 @@ func main() {
 
 		return toRun()
 	}
-
 	if err := run(); err != nil {
 		printStderr("\n\napp failed with error: %v\n", err)
 		os.Exit(1)

hack/zstd-dict/go.mod

@@ -1,6 +1,6 @@
 module github.com/siderolabs/omni-hack-zstd-dict
 
-go 1.24.4
+go 1.24.5
 
 require (
 	github.com/klauspost/compress v1.18.0

internal/backend/dns/service_test.go

@@ -30,6 +30,7 @@ const cluster = "test-cluster-1"
 
 type ServiceSuite struct {
 	suite.Suite
+
 	state state.State
 
 	dnsService *dns.Service

internal/backend/grpc/grpc_test.go

@@ -53,6 +53,7 @@ import (
 
 type GrpcSuite struct {
 	suite.Suite
+
 	runtime      *omniruntime.Runtime
 	server       *grpc.Server
 	conn         *grpc.ClientConn
@@ -235,7 +236,6 @@ func (suite *GrpcSuite) TestCrud() {
 			Namespace: resources.DefaultNamespace,
 			Type:      omni.ConfigPatchType,
 		})
-
 		if e != nil {
 			return e
 		}

internal/backend/grpc/router/talos_backend_test.go

@@ -38,6 +38,7 @@ func (t *testNodeResolver) Resolve(_, node string) dns.Info {
 func TestTalosBackendRoles(t *testing.T) {
 	// Start mock server.
 	const serverEndpoint = "127.0.0.1:10501"
+
 	serverCloser := startTestServer(must.Value(net.Listen("tcp", serverEndpoint))(t))
 
 	t.Cleanup(func() { require.NoError(t, serverCloser()) })

internal/backend/grpc/validate.go

@@ -102,7 +102,6 @@ func (s *managementServer) ValidateJSONSchema(ctx context.Context, request *mana
 	err = omnijsonschema.Validate(request.Data, schema)
 	if err != nil {
 		var validationError *jsonschema.ValidationError
-
 		if !errors.As(err, &validationError) {
 			return nil, err
 		}

internal/backend/imagefactory/client.go

@@ -24,9 +24,10 @@ import (
 
 // Client is the image factory client.
 type Client struct {
-	state state.State
 	*client.Client
-	host string
+
+	state state.State
+	host  string
 }
 
 // NewClient creates a new image factory client.

internal/backend/runtime/kubernetes/kubernetes.go

@@ -99,6 +99,7 @@ func NewWithTTL(omniState state.State, ttl time.Duration) (*Runtime, error) {
 // Runtime implements runtime.Runtime.
 type Runtime struct { //nolint:govet // there is just a single instance
 	cleanuperTracker
+
 	clientsCache *expirable.LRU[string, *Client]
 	sf           singleflight.Group
 

internal/backend/runtime/omni/audit/audit_test.go

@@ -108,6 +108,7 @@ func TestAudit(t *testing.T) {
 
 type wrapFS struct {
 	subFS
+
 	File string
 }
 

internal/backend/runtime/omni/audit/log_file.go

@@ -54,6 +54,7 @@ func (l *LogFile) Dump(data any) error {
 
 func (l *LogFile) dumpAt(data any, at time.Time) error {
 	b := l.pool.Get()
+
 	defer func() { b.Reset(); l.pool.Put(b) }()
 
 	err := json.NewEncoder(b).Encode(data)

internal/backend/runtime/omni/audit/state.go

@@ -14,14 +14,22 @@ import (
 
 // WrapState wraps the given state with audit log state.
 func WrapState(s state.State, l *Log) state.State {
-	return &auditState{
+	st := &auditState{
 		state:  s,
 		logger: l,
 	}
+
+	st.wrappedSelfState = state.WrapCore(st)
+
+	return st
 }
 
 type auditState struct {
-	state  state.State
+	state state.State
+
+	// we wrap this auditState itself to be able to implement Modify and ModifyWithResult methods
+	wrappedSelfState state.State
+
 	logger *Log
 }
 
@@ -138,3 +146,11 @@ func (a *auditState) RemoveFinalizer(ctx context.Context, pointer resource.Point
 func (a *auditState) ContextWithTeardown(ctx context.Context, pointer resource.Pointer) (context.Context, error) {
 	return a.state.ContextWithTeardown(ctx, pointer)
 }
+
+func (a *auditState) Modify(ctx context.Context, emptyResource resource.Resource, updateFunc func(resource.Resource) error, options ...state.UpdateOption) error {
+	return a.wrappedSelfState.Modify(ctx, emptyResource, updateFunc, options...)
+}
+
+func (a *auditState) ModifyWithResult(ctx context.Context, emptyResource resource.Resource, updateFunc func(resource.Resource) error, options ...state.UpdateOption) (resource.Resource, error) {
+	return a.wrappedSelfState.ModifyWithResult(ctx, emptyResource, updateFunc, options...)
+}

internal/backend/runtime/omni/controllers/omni/cluster_machine_config_status.go

@@ -760,7 +760,6 @@ func (h *clusterMachineConfigStatusControllerHandler) reset(
 			},
 		},
 	})
-
 	if err == nil {
 		attempt := h.ongoingResets.handleReset(clusterMachine.Metadata().ID())
 		logger.Info("resetting node", zap.Uint("attempt", attempt), zap.Bool("graceful", graceful))

internal/backend/runtime/omni/controllers/omni/etcd_backup_test.go

@@ -815,6 +815,7 @@ func toSlice(it iter.Seq2[etcdbackup.Info, error], t *testing.T) []etcdbackup.In
 
 type fakeBackend struct {
 	*s3mem.Backend
+
 	logger *zap.Logger
 }
 

internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/encrypt_test.go

@@ -320,6 +320,7 @@ func TestCrypt_Upload_Blocked(t *testing.T) {
 
 type backupBlocker struct {
 	etcdbackup.Store
+
 	block bool
 }
 

internal/backend/runtime/omni/controllers/omni/internal/task/machine/machine.go

@@ -39,6 +39,7 @@ import (
 // SchematicInfo contains all collected schematic information.
 type SchematicInfo struct {
 	talosschematic.SchematicInfo
+
 	Invalid bool
 }
 
@@ -317,7 +318,6 @@ func (spec CollectTaskSpec) RunTask(ctx context.Context, logger *zap.Logger, not
 	for {
 		if len(dirtyPollers) > 0 {
 			info, err := spec.poll(ctx, c, maps.Keys(dirtyPollers))
-
 			if !spec.sendInfo(ctx, info, notifyCh, err) {
 				return nil
 			}

internal/backend/runtime/omni/controllers/omni/loadbalancer_test.go

@@ -33,6 +33,7 @@ type mockLoadBalancer struct {
 
 func (lb *mockLoadBalancer) Start(upstreamCh <-chan []string) error {
 	var ctx context.Context
+
 	ctx, lb.ctxCancel = context.WithCancel(context.Background())
 
 	lb.wg.Add(2)

internal/backend/runtime/omni/controllers/omni/machine_request_link.go

@@ -90,7 +90,6 @@ func (ctrl *MachineRequestLinkController) Reconcile(ctx context.Context,
 
 		return nil
 	})
-
 	if state.IsPhaseConflictError(err) {
 		return nil
 	}

internal/backend/runtime/omni/controllers/omni/machine_request_set_status_test.go

@@ -76,6 +76,7 @@ func (suite *MachineRequestSetStatusSuite) TestReconcile() {
 	var eg errgroup.Group
 
 	reconcilerCtx, reconcilerCancel := context.WithCancel(ctx)
+
 	defer func() {
 		reconcilerCancel()
 

internal/backend/runtime/omni/controllers/omni/machine_set_etcd_audit.go

@@ -209,6 +209,7 @@ func (auditor *etcdAuditor) updateOrphanMembers(cluster string, currentOrphanedM
 
 	// log the previous orphans that are no longer orphans after the check is done
 	noMoreOrphansSet := xslices.ToSetFunc(xmaps.Keys(auditor.clusterToOrphanedMembers[cluster]), etcd.FormatMemberID)
+
 	defer func() {
 		// remove all orphans that are still orphans
 		for orphan := range auditor.clusterToOrphanedMembers[cluster] {

internal/backend/runtime/omni/controllers/omni/machine_set_etcd_audit_test.go

@@ -34,6 +34,7 @@ import (
 
 type MachineSetEtcdAuditSuite struct {
 	OmniSuite
+
 	clientFactory *talos.ClientFactory
 	resources     []resource.Resource
 }

internal/backend/runtime/omni/controllers/omni/machine_set_node.go

@@ -463,7 +463,6 @@ func (ctrl *MachineSetNodeController) deleteNodes(
 			ready bool
 			err   error
 		)
-
 		if ready, err = helpers.TeardownAndDestroy(ctx, r, usedMachineSetNodes[i].Metadata()); err != nil {
 			if state.IsNotFoundError(err) {
 				return nil

internal/backend/runtime/omni/controllers/omni/machine_set_node_test.go

@@ -31,6 +31,7 @@ import (
 
 type MachineSetNodeSuite struct {
 	OmniSuite
+
 	machinesOffset int
 }
 

internal/backend/runtime/omni/controllers/omni/machine_set_status_test.go

@@ -886,6 +886,7 @@ func (suite *MachineSetStatusSuite) TestMachineLocks() {
 	var eg errgroup.Group
 
 	ctx, cancel := context.WithTimeout(suite.ctx, time.Second*10)
+
 	defer func() {
 		cancel()
 

internal/backend/runtime/omni/controllers/omni/machine_status_link_test.go

@@ -24,6 +24,7 @@ import (
 
 type MachineStatusLinkSuite struct {
 	OmniSuite
+
 	deltaCh chan siderolinkmanager.LinkCounterDeltas
 }
 

internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go

@@ -247,6 +247,7 @@ func (ctrl *RedactedClusterMachineConfigController) saveDiff(ctx context.Context
 	}
 
 	const rfc3339Millis = "2006-01-02T15:04:05.000Z07:00"
+
 	diffID := cmcr.Metadata().ID() + "-" + ctrl.options.Clock.Now().UTC().Format(rfc3339Millis)
 	diffRes := omni.NewMachineConfigDiff(diffID)
 

internal/backend/runtime/omni/controllers/omni/reporting_test.go

@@ -51,7 +51,9 @@ func (suite *StripeMetricsReporterControllerSuite) TestReconcile() {
 			suite.Assert().Equal("/v1/subscription_items/sub_item_id", r.URL.Path)
 
 			mu.Lock()
+
 			count := machineCount
+
 			mu.Unlock()
 
 			w.WriteHeader(http.StatusOK)
@@ -76,7 +78,9 @@ func (suite *StripeMetricsReporterControllerSuite) TestReconcile() {
 			if quantityStr := r.Form.Get("quantity"); quantityStr != "" {
 				if newCount, err := strconv.ParseInt(quantityStr, 10, 64); err == nil {
 					mu.Lock()
+
 					machineCount = newCount
+
 					mu.Unlock()
 
 					w.WriteHeader(http.StatusOK)

internal/backend/runtime/omni/controllers/omni/secrets_test.go

@@ -59,6 +59,7 @@ func (suite *ClusterSecretsSuite) TestNewSecrets() {
 			suite.Require().NotEmpty(clusterSecretsSpec.GetData())
 
 			var bundle secrets.Bundle
+
 			err := json.Unmarshal(clusterSecretsSpec.Data, &bundle)
 			suite.Require().NoError(err)
 			suite.Require().NotEmpty(bundle)
@@ -150,6 +151,7 @@ func (suite *ClusterSecretsSuite) TestSecretsFromBackup() {
 			suite.Require().NotEmpty(clusterSecretsSpec.GetData())
 
 			var bundle secrets.Bundle
+
 			err := json.Unmarshal(clusterSecretsSpec.Data, &bundle)
 			suite.Require().NoError(err)
 			suite.Require().NotEmpty(bundle)

internal/backend/runtime/omni/migration/migration_test.go

@@ -59,6 +59,7 @@ import (
 
 type MigrationSuite struct {
 	suite.Suite
+
 	state   state.State
 	manager *migration.Manager
 	logger  *zap.Logger

internal/backend/runtime/omni/omni_test.go

@@ -64,6 +64,7 @@ func newTestResource(ns resource.Namespace, id resource.ID, spec *specs.AuthConf
 
 type OmniRuntimeSuite struct {
 	suite.Suite
+
 	runtime   *omniruntime.Runtime
 	ctx       context.Context //nolint:containedctx
 	ctxCancel context.CancelFunc

internal/backend/runtime/omni/state_access.go

@@ -466,7 +466,6 @@ func filterAccess(ctx context.Context, access state.Access) error {
 		var checkResult auth.CheckResult
 		// user management access
 		checkResult, err = auth.CheckGRPC(ctx, auth.WithRole(role.Admin))
-
 		if err == nil && (access.Verb == state.Destroy || access.Verb == state.Update) {
 			if access.ResourceType == authres.IdentityType && checkResult.Identity == access.ResourceID {
 				err = status.Errorf(codes.PermissionDenied, "destroying/updating resource %s is not allowed by the current user", access.ResourceID)

internal/backend/runtime/omni/state_etcd_election.go

@@ -56,7 +56,6 @@ func (ee *etcdElections) createSession(ctx context.Context, client *clientv3.Cli
 
 func (ee *etcdElections) run(ctx context.Context, client *clientv3.Client, electionKey string, errChan chan<- error) error {
 	var err error
-
 	if err = ee.createSession(ctx, client, electionKey); err != nil {
 		return err
 	}

internal/backend/runtime/omni/state_metrics.go

@@ -85,7 +85,6 @@ func (metrics *stateMetrics) Create(ctx context.Context, r resource.Resource, op
 	metrics.resourceOperations.WithLabelValues("create", r.Metadata().Type()).Inc()
 
 	err := metrics.st.Create(ctx, r, opts...)
-
 	if err == nil {
 		metrics.resourceThroughput.WithLabelValues("write", r.Metadata().Type()).Inc()
 	}
@@ -97,7 +96,6 @@ func (metrics *stateMetrics) Update(ctx context.Context, newResource resource.Re
 	metrics.resourceOperations.WithLabelValues("update", newResource.Metadata().Type()).Inc()
 
 	err := metrics.st.Update(ctx, newResource, opts...)
-
 	if err == nil {
 		metrics.resourceThroughput.WithLabelValues("write", newResource.Metadata().Type()).Inc()
 	}
@@ -109,7 +107,6 @@ func (metrics *stateMetrics) Destroy(ctx context.Context, r resource.Pointer, op
 	metrics.resourceOperations.WithLabelValues("destroy", r.Type()).Inc()
 
 	err := metrics.st.Destroy(ctx, r, opts...)
-
 	if err == nil {
 		metrics.resourceThroughput.WithLabelValues("write", r.Type()).Inc()
 	}

internal/backend/runtime/omni/validated/errors.go

@@ -58,7 +58,6 @@ func (e eValidation) GRPCStatus() *status.Status {
 // ValidationError generates error compatible with validated.ErrValidation.
 func ValidationError(err error) error {
 	var multiErr *multierror.Error
-
 	if errors.As(err, &multiErr) {
 		multiErr.Errors = distinct(multiErr.Errors)
 	}

internal/backend/runtime/omni/virtual/pkg/producers/kubernetes_usage.go

@@ -32,6 +32,7 @@ import (
 
 type kubernetesUsagePointer struct {
 	resource.Pointer
+
 	id string
 }
 
@@ -139,7 +140,6 @@ func (ku *KubernetesUsage) Start() error {
 
 			return nil
 		})
-
 		if state.IsNotFoundError(err) {
 			err = ku.state.Create(context.Background(), usage)
 		}

internal/backend/runtime/proxy_runtime_test.go

@@ -30,6 +30,7 @@ import (
 
 type runtimeMock struct {
 	runtime.Runtime
+
 	watch func(ctx context.Context, responses chan<- runtime.WatchResponse, option ...runtime.QueryOption) error
 	list  func(ctx context.Context, opts ...runtime.QueryOption) (runtime.ListResult, error)
 }

internal/backend/saml/saml.go

@@ -119,7 +119,6 @@ func createErrorHandler(logger *zap.Logger) func(http.ResponseWriter, *http.Requ
 
 	return func(w http.ResponseWriter, r *http.Request, err error) {
 		var invalidSAML *saml.InvalidResponseError
-
 		if errors.As(err, &invalidSAML) {
 			logger.Warn("received invalid saml response",
 				zap.String("response", invalidSAML.Response),

internal/backend/services/http_server.go

@@ -199,7 +199,6 @@ func (s *Server) listenAndServe(ctx context.Context, logger *zap.Logger) error {
 	eg.Go(func() error {
 		for {
 			err := s.certData.runWatcher(ctx, logger)
-
 			if err == nil {
 				return nil
 			}

internal/integration/workloadproxy/workloadproxy.go

@@ -392,7 +392,9 @@ func testAccessParallel(ctx context.Context, httpClient *http.Client, exposedSer
 
 			if err := testAccessSingleWithRetries(ctx, httpClient, svcURL, expectedStatusCode, expectedBodyContent, numRetries, cookies...); err != nil {
 				lock.Lock()
+
 				svcErrs[err.Error()] = err
+
 				lock.Unlock()
 			}
 		}()

internal/pkg/auth/check_test.go

@@ -211,7 +211,6 @@ func TestCheck(t *testing.T) {
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			result, err := auth.Check(tt.ctx, tt.opts...)
-
 			if tt.errorIs != nil {
 				assert.ErrorIs(t, err, tt.errorIs)
 

internal/pkg/auth/interceptor/jwt.go

@@ -82,7 +82,6 @@ func (i *JWT) intercept(ctx context.Context) (context.Context, error) {
 		i.logger.Info("invalid jwt", zap.Error(err))
 
 		var errEmailNotVerified *auth0.EmailNotVerifiedError
-
 		if errors.As(err, &errEmailNotVerified) {
 			return nil, status.Error(codes.Unauthenticated,
 				fmt.Sprintf(`Email address %q is not verified. Please check your email for a message to verify it, then click "Log In" again.`,

internal/pkg/auth/interceptor/signature_test.go

@@ -34,6 +34,7 @@ import (
 
 type testServer struct {
 	grpc_testing.UnimplementedTestServiceServer
+
 	t *testing.T
 }
 
@@ -43,11 +44,8 @@ func (s testServer) UnaryCall(_ context.Context, _ *grpc_testing.SimpleRequest)
 
 type SignatureTestSuite struct {
 	testServiceClient grpc_testing.TestServiceClient
-
-	clientConn *grpc.ClientConn
-
-	key *pgp.Key
-
+	clientConn        *grpc.ClientConn
+	key               *pgp.Key
 	test.GRPCSuite
 }
 

internal/pkg/auth/serviceaccount/errors.go

@@ -17,6 +17,7 @@ func (*eNotFound) NotFoundError() {}
 //nolint:errname
 type eConflict struct {
 	error
+
 	res resource.Pointer
 }
 

internal/pkg/auth/serviceaccount/serviceaccount.go

@@ -38,7 +38,6 @@ func Create(ctx context.Context, st state.State, name, userRole string, useUserR
 
 	if !useUserRole {
 		var err error
-
 		if saRole, err = role.Parse(userRole); err != nil {
 			return "", err
 		}

internal/pkg/config/services.go

@@ -94,6 +94,7 @@ func (s *Service) URL() string {
 // DevServerProxyService is used in Omni development and allows proxying through Omni to the node JS dev server.
 type DevServerProxyService struct {
 	Service `yaml:",inline"`
+
 	ProxyTo string `yaml:"proxyTo"`
 }
 

internal/pkg/constants/versions.go

@@ -12,7 +12,7 @@ import (
 )
 
 // AnotherTalosVersion is used in the integration tests for Talos upgrade.
-const AnotherTalosVersion = "1.10.1"
+const AnotherTalosVersion = "1.10.4"
 
 // MinDiscoveredTalosVersion makes Omni pull the versions from this point.
 const MinDiscoveredTalosVersion = "1.3.0"
@@ -23,10 +23,10 @@ const MinTalosVersion = "1.5.0"
 // DefaultKubernetesVersion is pre-selected in the UI and used in the integration tests.
 //
 // tsgen:DefaultKubernetesVersion
-const DefaultKubernetesVersion = "1.32.3"
+const DefaultKubernetesVersion = "1.33.2"
 
 // AnotherKubernetesVersion is used in the integration tests for Kubernetes upgrade.
-const AnotherKubernetesVersion = "1.31.7"
+const AnotherKubernetesVersion = "1.32.6"
 
 // MinKubernetesVersion allowed to be used when creating the cluster.
 const MinKubernetesVersion = "1.24.0"

internal/pkg/grpcutil/logger_test.go

@@ -40,6 +40,7 @@ func TestPayloadUnaryServerInterceptor(t *testing.T) {
 	defer runNoErr(listener.Close, "failed to close listener")
 
 	var dst bytes.Buffer
+
 	logger := newLogger(&dst)
 
 	server := grpc.NewServer(grpc.ChainUnaryInterceptor(

internal/pkg/grpcutil/stream_interceptors.go

@@ -56,6 +56,7 @@ type StreamHooks struct {
 
 type serverStreamHook struct {
 	grpc.ServerStream
+
 	info  *grpc.StreamServerInfo
 	hooks StreamHooks
 }

internal/pkg/logreceiver/logreceiver.go

@@ -93,6 +93,7 @@ func (srv *Server) Serve() error {
 
 		panichandler.Go(func() {
 			defer srv.wg.Done()
+
 			srv.handler.HandleConn(remoteAddr, conn)
 			srv.m.Remove(remoteAddress)
 		}, srv.logger)

internal/pkg/siderolink/machines.go

@@ -85,6 +85,7 @@ func (m *MachineCache) WriteMessage(id MachineID, rawData []byte) error {
 func (m *MachineCache) GetBuffer(id MachineID) (*circular.Buffer, error) {
 	m.mx.Lock()
 	defer m.mx.Unlock()
+
 	m.init()
 
 	val, ok := m.machineBuffers.Get(id)
@@ -116,6 +117,7 @@ func (m *MachineCache) GetBuffer(id MachineID) (*circular.Buffer, error) {
 func (m *MachineCache) GetWriter(id MachineID) (io.Writer, error) {
 	m.mx.Lock()
 	defer m.mx.Unlock()
+
 	m.init()
 
 	val, err := m.machineBuffers.GetOrCreate(id)

internal/pkg/siderolink/manager.go

@@ -219,7 +219,6 @@ func createListener(ctx context.Context, host, port string) (net.Listener, error
 		listener net.Listener
 		err      error
 	)
-
 	if err = retry.Constant(20*time.Second, retry.WithUnits(100*time.Millisecond)).RetryWithContext(
 		ctx, func(context.Context) error {
 			listener, err = net.Listen("tcp", endpoint)
@@ -582,7 +581,6 @@ func (manager *Manager) updateConnectionParams(ctx context.Context, siderolinkCo
 	)
 
 	var err error
-
 	if err = manager.state.Create(ctx, connectionParams); err != nil && !state.IsConflictError(err) {
 		return err
 	}
@@ -637,7 +635,9 @@ func (manager *Manager) Describe(ch chan<- *prometheus.Desc) {
 // Collect implements prom.Collector interface.
 func (manager *Manager) Collect(ch chan<- prometheus.Metric) {
 	ch <- manager.metricBytesReceived
+
 	ch <- manager.metricBytesSent
+
 	ch <- manager.metricLastHandshake
 }
 

internal/pkg/siderolink/provision.go

@@ -87,6 +87,7 @@ func NewProvisionHandler(logger *zap.Logger, state state.State, joinTokenMode st
 // ProvisionHandler is the gRPC service that handles provision responses coming from the Talos nodes.
 type ProvisionHandler struct {
 	pb.UnimplementedProvisionServiceServer
+
 	logger                 *zap.Logger
 	state                  state.State
 	joinTokenMode          string