From 7bc8fe306d8990cb9ee8ea00ba192834395ab538 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 10 Nov 2026 13:19:41 +0100 Subject: [PATCH 1/4] feat(storage): declare separate temporary Talos disk layouts --- ksail.prod.yaml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/ksail.prod.yaml b/ksail.prod.yaml index a5c0d52079..d6d7c64f54 100644 --- a/ksail.prod.yaml +++ b/ksail.prod.yaml @@ -134,6 +134,28 @@ spec: max: 2 labels: storage.platform.devantler.tech/migration-pool: v1 + talosPatches: + - | + --- + apiVersion: v1alpha1 + kind: VolumeConfig + name: EPHEMERAL + provisioning: + diskSelector: + match: system_disk + minSize: 40GiB + maxSize: -152GiB + grow: false + --- + apiVersion: v1alpha1 + kind: RawVolumeConfig + name: longhorn + provisioning: + diskSelector: + match: system_disk + minSize: 144GiB + maxSize: 144GiB + grow: false # Fresh raw-disk capacity; created after the worker layout changed. # Together with rebuilt permanent workers 1 and 2, this provides three # V2 targets while V1 retains worker 3 and its two migration workers. @@ -144,6 +166,33 @@ spec: max: 1 labels: storage.platform.devantler.tech/migration-pool: v2 + talosPatches: + - | + apiVersion: v1alpha1 + kind: VolumeConfig + name: EPHEMERAL + provisioning: + diskSelector: + match: system_disk + grow: false + minSize: 40GiB + maxSize: 44GiB + --- + apiVersion: v1alpha1 + kind: RawVolumeConfig + name: longhorn-stage + provisioning: + diskSelector: + match: system_disk + grow: false + minSize: 144GiB + maxSize: 144GiB + encryption: + provider: luks2 + keys: + - slot: 0 + nodeID: {} + lockToState: true - name: autoscale-cx43 serverType: cx43 location: fsn1 From ab7d9164fc8b7b643b31558799ce7ed7f6c3fb48 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 17:02:24 +0100 Subject: [PATCH 2/4] feat(storage): adopt released tooling for encrypted pool layouts --- .github/actions/deploy-prod/action.yml | 2 +- .github/workflows/cd.yaml | 2 +- .github/workflows/ci.yaml | 8 ++++---- .github/workflows/dr-rebuild.yaml | 2 +- .../prove-scoped-package-access.yaml | 2 +- .../validate-image-verifier-liveness.yaml | 2 +- .github/workflows/validate-main.yaml | 4 ++-- .../ksail-operator/oci-repository.yaml | 2 +- scripts/reconcile-talos-kernel-args/README.md | 19 +++++++++++++++++++ .../audited_inputs.go | 8 ++++++++ 10 files changed, 39 insertions(+), 12 deletions(-) diff --git a/.github/actions/deploy-prod/action.yml b/.github/actions/deploy-prod/action.yml index 18c6767fee..127e5b1253 100644 --- a/.github/actions/deploy-prod/action.yml +++ b/.github/actions/deploy-prod/action.yml @@ -84,7 +84,7 @@ runs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 109111830e..90f184125c 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -192,7 +192,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 5e8239d8f6..0260ae2b4d 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1955,7 +1955,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh @@ -3252,7 +3252,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh @@ -3686,7 +3686,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh @@ -4724,7 +4724,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/dr-rebuild.yaml b/.github/workflows/dr-rebuild.yaml index 9845f224d1..c229c4032e 100644 --- a/.github/workflows/dr-rebuild.yaml +++ b/.github/workflows/dr-rebuild.yaml @@ -180,7 +180,7 @@ jobs: # deploy-prod action; renovate keeps the pin current in all places. env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/.github/workflows/prove-scoped-package-access.yaml b/.github/workflows/prove-scoped-package-access.yaml index 096a82564f..6ec277a238 100644 --- a/.github/workflows/prove-scoped-package-access.yaml +++ b/.github/workflows/prove-scoped-package-access.yaml @@ -43,7 +43,7 @@ jobs: - name: Setup KSail for the existing encrypted pull credential env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/validate-image-verifier-liveness.yaml b/.github/workflows/validate-image-verifier-liveness.yaml index d68002fd31..ef6c725e6a 100644 --- a/.github/workflows/validate-image-verifier-liveness.yaml +++ b/.github/workflows/validate-image-verifier-liveness.yaml @@ -168,7 +168,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/validate-main.yaml b/.github/workflows/validate-main.yaml index 1896a4d1f8..6364981545 100644 --- a/.github/workflows/validate-main.yaml +++ b/.github/workflows/validate-main.yaml @@ -134,7 +134,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh @@ -327,7 +327,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.207.1" + KSAIL_VERSION: "7.213.4" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml b/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml index a65247a639..fef1455e60 100644 --- a/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml +++ b/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml @@ -11,7 +11,7 @@ spec: # the source exposes real readiness. url: oci://ghcr.io/devantler-tech/charts/ksail-operator ref: - tag: 7.207.1 + tag: 7.213.4 layerSelector: mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip operation: copy diff --git a/scripts/reconcile-talos-kernel-args/README.md b/scripts/reconcile-talos-kernel-args/README.md index 8b9930939c..28c0bf0045 100644 --- a/scripts/reconcile-talos-kernel-args/README.md +++ b/scripts/reconcile-talos-kernel-args/README.md @@ -612,3 +612,22 @@ silently skipped. Its [final-head provider trial](https://github.com/devantler-t verified a same-version image update, readiness, a second no-change plan and cleanup on a temporary single-node cluster. That trial does not cover autoscaled nodes or an interrupted rollout; the release's regression tests cover those paths. + +**7.213.4**, commit `695328215555c4d957498569f4cf788c7343dc4c`, retains +byte-identical configuration-manager and Talos-generator trees relative to +7.207.1. The fold's trigger, normalized arguments, both-role output and explicit +schematic-ID boundary are unchanged. The API adds ordered per-pool Talos patches +and observed host status; status preservation in its marshaler does not change +desired configuration. The chart adds those fields and a node-list permission +for nested Kind provisioning. Talos machinery and both YAML encoders are +unchanged; COSI runtime moves from 1.16.3 to 1.16.4, Kubernetes clients from +0.36.5 to 0.36.6, and the build toolchain from Go 1.27.3 to 1.27.4. + +The source audit covers the published releases and complete commit range from +7.207.0 through 7.213.4, including changes between retained unpublished tags. +Per-pool patches are applied after shared worker configuration; they do not +replace this shared post-installer fold. The consumer fixtures exercise all +five pool profiles during bootstrap and reconciliation with the patched +toolchain, and their generated configurations validate with Talos 1.13.12. +The offline render regression still checks both shared roles, schematic-ID +precedence and invalid-patch refusal. This audit changes no runtime exception. diff --git a/scripts/reconcile-talos-kernel-args/audited_inputs.go b/scripts/reconcile-talos-kernel-args/audited_inputs.go index f115872a2c..158fc62371 100644 --- a/scripts/reconcile-talos-kernel-args/audited_inputs.go +++ b/scripts/reconcile-talos-kernel-args/audited_inputs.go @@ -361,6 +361,14 @@ var auditedFoldInputs = []struct { "go.mod": "8a0c631d5c12dbe3fbcc1f2dba7374476457ab74", "go.sum": "1a9d7d5860e52a2aa5ab5ac7e1a06f35996423a0", }}, + {"7.213.4", map[string]string{ + "pkg/fsutil/configmanager": "51dbdaf40c1bc6bc3eb1018ccdf29588cca13fd5", + "pkg/fsutil/generator/talos": "25c9c416e06b77937e68e71a213c1b2e9ed61205", + "pkg/apis": "2cc7c7d8a796e1160456db2823e0e87a918c931b", + "charts": "d404672b26c6fd7bc741ca1fd29fa1ea10e045bc", + "go.mod": "25edcda6b27a76716c758753ebec1ff66008cb50", + "go.sum": "484daeaf917de0194dbcdd324c03a0a9ae760fbd", + }}, } // verifyFoldInputs passes only when every fold input of the pinned release was From 8a3e76124dc67eabd9c6104a4786ee0105095a6f Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 17:39:57 +0100 Subject: [PATCH 3/4] test(storage): record the reviewed operator node inventory permission Part of #5787. The released operator adds only core nodes/list to account for host node networks during nested Kind provisioning. Regenerate the exact-grant fixture through its existing generator; preserve policy exclusions, write permissions and all broadening/aggregation negative controls. --- .../excluded-role-grants.json | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tests/chart-rendered-rbac-policy/excluded-role-grants.json b/tests/chart-rendered-rbac-policy/excluded-role-grants.json index 80a1dc89bf..5279abd635 100644 --- a/tests/chart-rendered-rbac-policy/excluded-role-grants.json +++ b/tests/chart-rendered-rbac-policy/excluded-role-grants.json @@ -893,6 +893,17 @@ "watch" ] }, + { + "apiGroups": [ + "" + ], + "resources": [ + "nodes" + ], + "verbs": [ + "list" + ] + }, { "apiGroups": [ "apiextensions.k8s.io" From ed7ab875b2b8363e08c6139bef91eb30978e3472 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 17:59:31 +0100 Subject: [PATCH 4/4] docs(storage): reference the canonical Talos validation client --- scripts/reconcile-talos-kernel-args/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/reconcile-talos-kernel-args/README.md b/scripts/reconcile-talos-kernel-args/README.md index 624a8ddb01..1e7929f055 100644 --- a/scripts/reconcile-talos-kernel-args/README.md +++ b/scripts/reconcile-talos-kernel-args/README.md @@ -640,6 +640,7 @@ The source audit covers the published releases and complete commit range from Per-pool patches are applied after shared worker configuration; they do not replace this shared post-installer fold. The consumer fixtures exercise all five pool profiles during bootstrap and reconciliation with the patched -toolchain, and their generated configurations validate with Talos 1.13.12. +toolchain, and their generated configurations validate with the platform's +pinned Talos client. The offline render regression still checks both shared roles, schematic-ID precedence and invalid-patch refusal. This audit changes no runtime exception.