chore(talos): move to v1.13.9 #656

2026-08-27T06:56:46Z

claude-bot commented

2026-08-27 06:56:46 +00:00

Nodes run v1.12.11, which is the last 1.12 patch — v1.12.12 does not exist. v1.13.9 is current.

The upgrade path is the documented one, not a shortcut. Migration is only tested between adjacent minor releases, and the recommendation is to go to the latest patch of each intermediate minor. 1.12.11 -> 1.13.9 satisfies both: one minor step, taken from the last patch of the version being left. No intermediate hop needed.

Kubernetes is not forced along. Talos 1.13 support matrix:

Talos Version   1.13                                 1.12
Kubernetes      1.36, 1.35, 1.34, 1.33, 1.32, 1.31   1.35, 1.34, 1.33, 1.32, 1.31, 1.30

The cluster runs 1.35.2, so it stays there until talosctl upgrade-k8s moves it as a separate decision. This was the one open question before the jump; it is answered from the matrix rather than assumed.

Deprecations checked against this cluster, not just read:

deprecation	here
`.machine.env` → `EnvironmentConfig`	not used
`.machine.network.kubespan` → `KubeSpanConfig`	not used
`EtcdConfigs`/`KubeletConfigs` protobuf change	no consumer in this repo
legacy upgrade API → `LifecycleService`	still functional — `talosctl upgrade` keeps working; matters only once removed

The first two were checked in both the five machine-config files here and the live config on k8s-1, because the running config is generated from a base this repo only patches and could carry fields the patches never mention. Neither appears in either.

The removed interactive installer and dropped talosctl install do not apply — installation here is talosctl upgrade --image plus Image Factory media.

Schematic unchanged; the factory image was verified to exist for the new tag before committing. The cold-rebuild ISO URL moves with it.

Not applied to any node. Rollout is drain → upgrade → wait for Ceph to return to 217 PGs active+clean, one node at a time, as in the 1.12.11 run. Expect the same two follow-ons that run produced: a mon failover per node whose DHCP lease moves, and OpenBao replicas sealing as each node drains — the latter now visible via the alerts from #647 instead of silent.

Nodes run **v1.12.11**, which is the last 1.12 patch — v1.12.12 does not exist. **v1.13.9** is current. **The upgrade path is the documented one, not a shortcut.** Migration is only tested between adjacent minor releases, and the recommendation is to go to the latest patch of each intermediate minor. `1.12.11 -> 1.13.9` satisfies both: one minor step, taken from the last patch of the version being left. No intermediate hop needed. **Kubernetes is not forced along.** Talos 1.13 support matrix: ``` Talos Version 1.13 1.12 Kubernetes 1.36, 1.35, 1.34, 1.33, 1.32, 1.31 1.35, 1.34, 1.33, 1.32, 1.31, 1.30 ``` The cluster runs 1.35.2, so it stays there until `talosctl upgrade-k8s` moves it as a separate decision. This was the one open question before the jump; it is answered from the matrix rather than assumed. **Deprecations checked against this cluster, not just read:** | deprecation | here | |---|---| | `.machine.env` → `EnvironmentConfig` | not used | | `.machine.network.kubespan` → `KubeSpanConfig` | not used | | `EtcdConfigs`/`KubeletConfigs` protobuf change | no consumer in this repo | | legacy upgrade API → `LifecycleService` | still functional — `talosctl upgrade` keeps working; matters only once removed | The first two were checked in **both** the five machine-config files here and the live config on k8s-1, because the running config is generated from a base this repo only patches and could carry fields the patches never mention. Neither appears in either. The removed interactive installer and dropped `talosctl install` do not apply — installation here is `talosctl upgrade --image` plus Image Factory media. Schematic unchanged; the factory image was verified to exist for the new tag before committing. The cold-rebuild ISO URL moves with it. **Not applied to any node.** Rollout is drain → upgrade → wait for Ceph to return to 217 PGs `active+clean`, one node at a time, as in the 1.12.11 run. Expect the same two follow-ons that run produced: a mon failover per node whose DHCP lease moves, and OpenBao replicas sealing as each node drains — the latter now visible via the alerts from #647 instead of silent.

claude-bot added 1 commit 2026-08-27 06:56:47 +00:00

chore(talos): move to v1.13.9

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

3abdeb2203

Nodes run v1.12.11, which is the last 1.12 patch — v1.12.12 does not exist.
v1.13.9 is current.

The upgrade path is the documented one rather than a shortcut. Migration is
only tested between adjacent minor releases, and the recommendation is to go
to the latest patch of each intermediate minor. 1.12.11 -> 1.13.9 satisfies
both: one minor step, taken from the last patch of the version being left. No
intermediate hop is needed.

Kubernetes is not forced along. Talos 1.13's support matrix lists 1.36, 1.35,
1.34, 1.33, 1.32 and 1.31, and the cluster runs 1.35.2 — so it stays there
until `talosctl upgrade-k8s` moves it as a separate decision. This was the one
open question before the jump and it is answered from the matrix rather than
assumed.

Deprecations in 1.13 were checked against this cluster, not just read:

  .machine.env -> EnvironmentConfig          not used
  .machine.network.kubespan -> KubeSpanConfig not used
  EtcdConfigs/KubeletConfigs protobuf change  no consumer in this repo
  legacy upgrade API -> LifecycleService      still functional; `talosctl
                                              upgrade` keeps working, this
                                              only matters once it is removed

Both the five machine-config files here and the live config on k8s-1 were
checked for the first two, because the running config is generated from a base
this repo only patches and could carry fields the patches never mention.
Neither appears in either.

The removed interactive installer and the dropped `talosctl install` do not
apply — installation here is `talosctl upgrade --image` and Image Factory
media.

Schematic is unchanged; the factory image was verified to exist for the new
tag before committing. The cold-rebuild ISO URL moves with it.

Not applied to any node. Rolling it out is drain -> upgrade -> wait for Ceph
to return to 217 PGs active+clean, one node at a time, as in the 1.12.11 run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

k.renner merged commit 7b0b664a46 into master

2026-08-27 06:57:58 +00:00

k.renner referenced this issue from a commit

2026-08-27 06:58:00 +00:00

Merge pull request 'chore(talos): move to v1.13.9' (#656) from talos-1-13-9 into master

review-bot reviewed

2026-08-27 06:58:44 +00:00

review-bot left a comment

🤖 Automated review — model claude-haiku-4-5-20251001 (complexity: trivial), commit 3abdeb220325b4aa8614d846310a90e400ad9d27.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This PR updates the Talos cluster from v1.12.11 to v1.13.9, a single minor version step following the documented upgrade path. The changes are minimal and well-justified: two files are updated with consistent version bumps (cold-rebuild runbook ISO URL and the cluster config installer image), accompanied by clear comments explaining the upgrade decision and Kubernetes version handling.

🟢 Nits

The comment on line 48 in cluster.yaml uses 1.12.11 -> 1.13.9 notation; this accurately reflects the upgrade path and is consistent with the PR title/body, so no change needed.

Tests

This is infrastructure configuration rather than testable code. The PR body documents thorough pre-commit verification:

Factory image existence confirmed for the new tag
Deprecations checked against both the config files and live cluster state
Schematic hash unchanged (hardware extensions unchanged)
Kubernetes version compatibility verified (1.35.2 remains supported on Talos 1.13)

The actual upgrade follows a documented rollout procedure (drain → upgrade → Ceph health check, one node at a time) with expected side effects documented.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-haiku-4-5-20251001` (complexity: trivial), commit `3abdeb220325b4aa8614d846310a90e400ad9d27`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR updates the Talos cluster from v1.12.11 to v1.13.9, a single minor version step following the documented upgrade path. The changes are minimal and well-justified: two files are updated with consistent version bumps (cold-rebuild runbook ISO URL and the cluster config installer image), accompanied by clear comments explaining the upgrade decision and Kubernetes version handling. ## 🟢 Nits - The comment on line 48 in `cluster.yaml` uses `1.12.11 -> 1.13.9` notation; this accurately reflects the upgrade path and is consistent with the PR title/body, so no change needed. ## Tests This is infrastructure configuration rather than testable code. The PR body documents thorough pre-commit verification: - Factory image existence confirmed for the new tag - Deprecations checked against both the config files and live cluster state - Schematic hash unchanged (hardware extensions unchanged) - Kubernetes version compatibility verified (1.35.2 remains supported on Talos 1.13) The actual upgrade follows a documented rollout procedure (drain → upgrade → Ceph health check, one node at a time) with expected side effects documented. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#656