diff --git a/.github/actions/deploy-prod/action.yml b/.github/actions/deploy-prod/action.yml index 813219a693..127e5b1253 100644 --- a/.github/actions/deploy-prod/action.yml +++ b/.github/actions/deploy-prod/action.yml @@ -84,7 +84,7 @@ runs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index c00c1b87cd..ebf9963e74 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -192,7 +192,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index a9d8ebbbcb..f7bc12854e 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1958,7 +1958,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh @@ -3265,7 +3265,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh @@ -3699,7 +3699,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh @@ -4745,7 +4745,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/dr-rebuild.yaml b/.github/workflows/dr-rebuild.yaml index 329a584b44..c229c4032e 100644 --- a/.github/workflows/dr-rebuild.yaml +++ b/.github/workflows/dr-rebuild.yaml @@ -180,7 +180,7 @@ jobs: # deploy-prod action; renovate keeps the pin current in all places. env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/.github/workflows/prove-scoped-package-access.yaml b/.github/workflows/prove-scoped-package-access.yaml index 379b69ef53..6ec277a238 100644 --- a/.github/workflows/prove-scoped-package-access.yaml +++ b/.github/workflows/prove-scoped-package-access.yaml @@ -43,7 +43,7 @@ jobs: - name: Setup KSail for the existing encrypted pull credential env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/validate-image-verifier-liveness.yaml b/.github/workflows/validate-image-verifier-liveness.yaml index d6e0efa87d..ef6c725e6a 100644 --- a/.github/workflows/validate-image-verifier-liveness.yaml +++ b/.github/workflows/validate-image-verifier-liveness.yaml @@ -168,7 +168,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/validate-main.yaml b/.github/workflows/validate-main.yaml index 3b71ff50ea..fce7b0c718 100644 --- a/.github/workflows/validate-main.yaml +++ b/.github/workflows/validate-main.yaml @@ -134,7 +134,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh @@ -327,7 +327,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.210.0" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml b/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml index 0ffcbe5e19..fef1455e60 100644 --- a/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml +++ b/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml @@ -11,7 +11,7 @@ spec: # the source exposes real readiness. url: oci://ghcr.io/devantler-tech/charts/ksail-operator ref: - tag: 7.210.0 + tag: 7.213.4 layerSelector: mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip operation: copy diff --git a/ksail.prod.yaml b/ksail.prod.yaml index a5c0d52079..d6d7c64f54 100644 --- a/ksail.prod.yaml +++ b/ksail.prod.yaml @@ -134,6 +134,28 @@ spec: max: 2 labels: storage.platform.devantler.tech/migration-pool: v1 + talosPatches: + - | + --- + apiVersion: v1alpha1 + kind: VolumeConfig + name: EPHEMERAL + provisioning: + diskSelector: + match: system_disk + minSize: 40GiB + maxSize: -152GiB + grow: false + --- + apiVersion: v1alpha1 + kind: RawVolumeConfig + name: longhorn + provisioning: + diskSelector: + match: system_disk + minSize: 144GiB + maxSize: 144GiB + grow: false # Fresh raw-disk capacity; created after the worker layout changed. # Together with rebuilt permanent workers 1 and 2, this provides three # V2 targets while V1 retains worker 3 and its two migration workers. @@ -144,6 +166,33 @@ spec: max: 1 labels: storage.platform.devantler.tech/migration-pool: v2 + talosPatches: + - | + apiVersion: v1alpha1 + kind: VolumeConfig + name: EPHEMERAL + provisioning: + diskSelector: + match: system_disk + grow: false + minSize: 40GiB + maxSize: 44GiB + --- + apiVersion: v1alpha1 + kind: RawVolumeConfig + name: longhorn-stage + provisioning: + diskSelector: + match: system_disk + grow: false + minSize: 144GiB + maxSize: 144GiB + encryption: + provider: luks2 + keys: + - slot: 0 + nodeID: {} + lockToState: true - name: autoscale-cx43 serverType: cx43 location: fsn1 diff --git a/scripts/reconcile-talos-kernel-args/README.md b/scripts/reconcile-talos-kernel-args/README.md index b73a3071d6..1e7929f055 100644 --- a/scripts/reconcile-talos-kernel-args/README.md +++ b/scripts/reconcile-talos-kernel-args/README.md @@ -624,3 +624,23 @@ silently skipped. Its [final-head provider trial](https://github.com/devantler-t verified a same-version image update, readiness, a second no-change plan and cleanup on a temporary single-node cluster. That trial does not cover autoscaled nodes or an interrupted rollout; the release's regression tests cover those paths. + +**7.213.4**, commit `695328215555c4d957498569f4cf788c7343dc4c`, retains +byte-identical configuration-manager and Talos-generator trees relative to +7.207.1. The fold's trigger, normalized arguments, both-role output and explicit +schematic-ID boundary are unchanged. The API adds ordered per-pool Talos patches +and observed host status; status preservation in its marshaler does not change +desired configuration. The chart adds those fields and a node-list permission +for nested Kind provisioning. Talos machinery and both YAML encoders are +unchanged; COSI runtime moves from 1.16.3 to 1.16.4, Kubernetes clients from +0.36.5 to 0.36.6, and the build toolchain from Go 1.27.3 to 1.27.4. + +The source audit covers the published releases and complete commit range from +7.207.0 through 7.213.4, including changes between retained unpublished tags. +Per-pool patches are applied after shared worker configuration; they do not +replace this shared post-installer fold. The consumer fixtures exercise all +five pool profiles during bootstrap and reconciliation with the patched +toolchain, and their generated configurations validate with the platform's +pinned Talos client. +The offline render regression still checks both shared roles, schematic-ID +precedence and invalid-patch refusal. This audit changes no runtime exception. diff --git a/scripts/reconcile-talos-kernel-args/audited_inputs.go b/scripts/reconcile-talos-kernel-args/audited_inputs.go index 2468fafc8f..10322464fb 100644 --- a/scripts/reconcile-talos-kernel-args/audited_inputs.go +++ b/scripts/reconcile-talos-kernel-args/audited_inputs.go @@ -369,6 +369,14 @@ var auditedFoldInputs = []struct { "go.mod": "832fc16ab44bcfbba8759238575fc1ea0fba5c7b", "go.sum": "1a9d7d5860e52a2aa5ab5ac7e1a06f35996423a0", }}, + {"7.213.4", map[string]string{ + "pkg/fsutil/configmanager": "51dbdaf40c1bc6bc3eb1018ccdf29588cca13fd5", + "pkg/fsutil/generator/talos": "25c9c416e06b77937e68e71a213c1b2e9ed61205", + "pkg/apis": "2cc7c7d8a796e1160456db2823e0e87a918c931b", + "charts": "d404672b26c6fd7bc741ca1fd29fa1ea10e045bc", + "go.mod": "25edcda6b27a76716c758753ebec1ff66008cb50", + "go.sum": "484daeaf917de0194dbcdd324c03a0a9ae760fbd", + }}, } // verifyFoldInputs passes only when every fold input of the pinned release was diff --git a/tests/chart-rendered-rbac-policy/excluded-role-grants.json b/tests/chart-rendered-rbac-policy/excluded-role-grants.json index 80a1dc89bf..5279abd635 100644 --- a/tests/chart-rendered-rbac-policy/excluded-role-grants.json +++ b/tests/chart-rendered-rbac-policy/excluded-role-grants.json @@ -893,6 +893,17 @@ "watch" ] }, + { + "apiGroups": [ + "" + ], + "resources": [ + "nodes" + ], + "verbs": [ + "list" + ] + }, { "apiGroups": [ "apiextensions.k8s.io"