When `talosctl dashboard` is used with node "aliases" (e.g., node names or machine IDs in Omni) passed via `-n` flag, the graphs in the monitor tab were not rendered correctly: The matching of the old and current data were done incorrectly.
Fix this by pushing node alias->IP resolution down to the (api & log) data sources of the dashboard, by passing a resolver to them.
Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>
This is required in Image Factory to manipulate properly the imager
profile when enabling an option for well-known UEFI certificates.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
The main etcd tag is now multiarch so the special case isn't needed.
Signed-off-by: Steven Fackler <sfackler@gmail.com>
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
`disabled` was removed in https://github.com/cilium/cilium/pull/31286
Signed-off-by: Daniel Höxtermann <daniel@hxtm.dev>
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Extensions are posted the following way:
`extensions.talos.dev/<name>=<version>`
The name should be valid as a label (annotation) key.
If the value is valid as a label value, use labels, otherwise use
annotations.
Also implements node annotations in the machine config as a side-effect.
Fixes#9089Fixes#8971
See #9070
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Provide `XDG_RUNTIME_DIR` environment variable, this specifically fixes
the `kubectl exec` action when `/tmp` is filled up.
Update containerd configuration to version 3 and fix it up.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Signed-off-by: Noel Georgi <git@frezbo.dev>
Following the most recent livestream, I'm adding in a few small fixes, specifically:
* Using `metros` instead of `facilities` as the latter is deprecated (https://deploy.equinix.com/developers/docs/metal/locations/facilities/)
Signed-off-by: Steve Martinelli <4118756+stevemar@users.noreply.github.com>
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Generating YAML using text templates is going to stop working because of
proper escaping.
Also fix unrelated issue with `cloud.google.com/go` module which got
split into submodules, and now this conflicts with each other.
Fixes#7180
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Add a `runc-memfd-bind` service so that runc binary is not copied for
every `runc` invocation.
Fixes: #9007.
Signed-off-by: Noel Georgi <git@frezbo.dev>
Add `"` to handle vmware network interfaces with non-characters name
Signed-off-by: Fredrik Lundhag <f@mekk.com>
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Add test for Gvisor extensions when kvm platform is used.
The test is marked as skipped until pod termination issue is resolved.
Signed-off-by: Noel Georgi <git@frezbo.dev>
when kernel not support ethtool-netlink,we will use ethtool-ioctl to get link status
Signed-off-by: EricMa <307748790@qq.com>
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
This patch adds a flag to `secureboot.database.Generate` to append the
Microsoft UEFI secure boot DB and KEK certificates to the appropriate
ESLs, in addition to complimentary command line flags.
This patch also includes a copy of said Microsoft certificates. The
certificates are downloaded from an official Microsoft repo.
Signed-off-by: Jean-Francois Roy <jf@devklog.net>
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Fixes#8690
Consider the following scenario (e.g. OpenStack): platform issues a
correct list of DNS servers, which includes both IPv4 and IPv6
resolvers, and configures DHCPv4 on the interface.
DHCPv4 returns a set of IPv4 resolvers (as it can't return IPv6 ones),
and this list completely overrides the list from the platform, wiping
out the IPv6 resolvers completely.
With this change, the merge process is more smart, as it tries to
preserve IPv6 resolvers for example if the next layer provides no
resolvers for IPv6.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
We missed passing the log formatting options while printing logs in a couple places, causing the logs to be in inconsistent format.
Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>
Fixes#9009
When building a port interval set, sort the ports and merge adjacent
ranges to prevent mismatch on the nftables side.
With address sets, this was already the case due to the way IPRange
builder works, but ports need a manual implementation.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Fixes#8995
There is no security impact, as the actual SecureBoot
state/configuration is measured into the PCR 7 and the disk encryption
key unsealing is tied to this value.
This is more to provide a way to avoid accidentally encrypting to the
TPM while SecureBoot is not enabled.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Ensure that SecureBoot enabled images come before regular ones.
With Ubuntu 24.04 `ovmf` package, due to the ordering of the search
paths `talosctl` might pick up a wrong image and disable SecureBoot.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Compute command missing backslashes for new lines
Seq in for loop used incorrect numbering
Signed-off-by: Justin Garrison <justin.garrison@siderolabs.com>
Not sure why this mount was needed, but it was added long time ago, and
I believe it's no longer needed.
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Simple change:
1. `FilterMessages` became `filterMessages`.
2. `FilterMessages` is now typed generic function which calls `filterMessages` internally.
3. Adjusted callsites of `FilterMessages`.
Most of the reflection can be avoided in `filterMessages` body (aside from setting `Messages` field
which can be done using proto reflection mechanisms). But for now, lets stick to the simple change.
Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>
Bump github.com/siderolabs/grpc-proxy to v0.4.1 and replace deprecated calls to `grpc.CustomCodec`.
Signed-off-by: Dmitriy Matrenichev <dmitry.matrenichev@siderolabs.com>
The Mayastor helm chart ships with an init container that won't mount /sys and runs lsmod.
Add a note in the guide as this is not obvious.
Signed-off-by: Syoc <Syoc@users.noreply.github.com>
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
