> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What's New in Talos 1.7.0

> List of new and shiny features in Talos Linux.

export const VersionWarningBanner = () => {
  const latestVersion = "v1.13";
  const [latestUrl, setLatestUrl] = useState(null);
  const [currentVersion, setCurrentVersion] = useState(null);
  const [isBeta, setIsBeta] = useState(false);
  const parseVersion = v => v.replace("v", "").split(".").map(Number);
  const isGreaterVersion = (a, b) => {
    const [aMajor, aMinor] = parseVersion(a);
    const [bMajor, bMinor] = parseVersion(b);
    if (aMajor > bMajor) return true;
    if (aMajor === bMajor && aMinor > bMinor) return true;
    return false;
  };
  useEffect(() => {
    if (typeof window === "undefined") return;
    const {pathname, hash, search} = window.location;
    const match = pathname.match(/\/talos\/(v\d+\.\d+)\//);
    if (!match) return;
    const detectedVersion = match[1];
    if (detectedVersion === latestVersion) return;
    setCurrentVersion(detectedVersion);
    if (isGreaterVersion(detectedVersion, latestVersion)) {
      setIsBeta(true);
    }
    const newPath = pathname.replace(`/talos/${detectedVersion}/`, `/talos/${latestVersion}/`);
    setLatestUrl(`${newPath}${search}${hash}`);
  }, []);
  if (!latestUrl || !currentVersion) return null;
  return <div className="not-prose sticky top-6 z-50 my-6">
      <div className="border border-yellow-500/30 bg-yellow-500/10 px-4 py-3 rounded-xl">
        <div className="text-sm">
          {isBeta ? <>
              ⚠️ You are viewing a <strong>beta version</strong> of Talos ({currentVersion}).
              This version may be unstable.
              <a href={latestUrl} className="ml-2 underline text-yellow-400 hover:text-yellow-300 font-medium">
                View latest stable version {latestVersion} →
              </a>
            </> : <>
              ⚠️ You are viewing an older version of Talos ({currentVersion}).
              <a href={latestUrl} className="ml-2 underline text-yellow-400 hover:text-yellow-300 font-medium">
                View the latest version {latestVersion} →
              </a>
            </>}
        </div>
      </div>
    </div>;
};

<VersionWarningBanner />

See also [upgrade notes](../configure-your-talos-cluster/lifecycle-management/upgrading-talos) for important changes.

## Important Changes

* The [default NTP server](#time-sync) was updated to `time.cloudflare.com` instead of `pool.ntp.org` (only if not specified in the machine configuration).
* Talos Linux [now](#iptables) forces `kubelet` and `kube-proxy` to use `iptables-nft` instead of `iptables-legacy`.
* SBC (Single Board Computers) images are no longer part of the Talos release assets, please read [SBC](#sbc) before upgrading.
* Talos clusters created with `talosctl cluster create` in Docker mode now use a [random port](#containers-docker) for Kubernetes and Talos API.

## Security

### CA Rotation

Talos Linux now supports [rotating the root CA certificate and key](../security/certificate-authorities) for Talos API and Kubernetes API.

## Networking

### Device Selectors

Talos Linux now supports `physical: true` qualifier for [device selectors](../networking/device-selector), it selects non-virtual network interfaces (i.e. `en0` is selected, while `bond0` is not).

### DNS Caching

Talos Linux now provides a [caching DNS resolver](../networking/host-dns) for host workloads (including host networking pods).
Host DNS resolver is enabled by default for clusters created with Talos 1.7.

### Time Sync

Default [NTP server](../configure-your-talos-cluster/system-configuration/time-sync) was updated to be `time.cloudflare.com` instead of `pool.ntp.org`.
Default server is only used if the user does not specify any NTP servers in the configuration.

Talos Linux can now sync to PTP devices (e.g. provided by the hypervisor) skipping the network time servers.
In order to activate PTP sync, set `machine.time.servers` to the PTP device name (e.g. `/dev/ptp0`):

```yaml theme={null}
machine:
  time:
    servers:
      - /dev/ptp0
```

### SideroLink HTTP Proxy

[SideroLink](../networking/siderolink) connections can now proxy Wireguard UDP packet over existing HTTP/2 SideroLink API connection (for networks where UDP protocol is filtered, but HTTP is allowed).

## Kubernetes

### API Server Service Account Key

Talos Linux 1.7.0 when generating machine configuration uses RSA key for Kubernetes API Server Service Account instead of ECDSA key to provide better compatibility with external OpenID Connect implementations.

### IPTables

Talos Linux now forces `kubelet` and `kube-proxy` to use `iptables-nft` instead of `iptables-legacy` (`xtables`) which was the default
before Talos 1.7.0.

Container images based on `iptables-wrapper` should work without changes, but if there was a direct call to `legacy` mode of `iptables`, make sure
to update to use `iptables-nft`.

## Platforms

### New Supported Platforms

Talos Linux now supports:

* [OpenNebula](https://opennebula.io/) platform ([Talos platform `opennebula`](../platform-specific-installations/virtualized-platforms/opennebula))
* [Akamai Connected Cloud](https://www.linode.com/) provider ([Talos platform `akamai`](../platform-specific-installations/cloud-platforms/akamai))

### Containers (`docker`)

The `talosctl cluster create` command now can create [multiple Talos clusters on the same machine](../platform-specific-installations/local-platforms/docker).
The Kubernetes and Talos APIs are mapped to a random port on the host machine.

Talos Linux now uses provided DNS resolver when running inside a container.

### Talos-in-Kubernetes

Talos Linux now supports running Talos inside [Kubernetes as a pod](../platform-specific-installations/cloud-platforms/kubernetes): e.g. to run controlplane nodes inside existing Kubernetes cluster.

## SBC

Talos has split the SBC's (Single Board Computers) into separate repositories.
There will not be any more SBC specific release assets as part of Talos release.

The default Talos `installer` image will stop working for SBC's and will fail the upgrade, if used, starting from Talos v1.7.0.

The SBC's images and installers can be generated on the fly using [Image Factory](https://factory.talos.dev) or using [imager](../platform-specific-installations/boot-assets) for custom images.
The list of official SBC's images supported by Image Factory can be found in the [overlays](https://github.com/siderolabs/overlays/) repository.

In order to upgrade an SBC running Talos 1.6 to Talos 1.7, generate an `installer` image with an SBC overlay and use it to upgrade the cluster.

## System Extensions

### Extension Services Configuration

Talos now supports supplying configuration files and environment variables for extension services.
The extension service configuration is a separate config document.
An example is shown below:

```yaml theme={null}
---
apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: nut-client
configFiles:
  - content: MONITOR ${upsmonHost} 1 remote pass password
    mountPath: /usr/local/etc/nut/upsmon.conf
environment:
  - UPS_NAME=ups
```

For documentation, see [Extension Services Config Files](../reference/configuration/extensions/extensionserviceconfig).

> **Note**: The use of `environmentFile` in extension service [spec](../build-and-extend-talos/custom-images-and-development/extension-services) is now deprecated and will be removed in a future release of Talos,
> use `ExtensionServiceConfig` instead.

### New Extensions

Talos Linux in version v1.7 introduces new [extensions](https://github.com/siderolabs/extensions):

* `kata-containers`
* `spin`
* `v4l-uvc-drivers`
* `vmtoolsd-guest-agent`
* `wasmedge`
* `xen-guest-agent`

## Logging

### Additional Tags

Talos Linux now supports setting [extra tags](../configure-your-talos-cluster/logging-and-telemetry/logging) when sending logs in JSON format:

```yaml theme={null}
machine:
  logging:
    destinations:
      - endpoint: "udp://127.0.0.1:12345/"
        format: "json_lines"
        extraTags:
          server: s03-rack07
```

### Syslog

Talos Linux now starts a basic syslog receiver listening on `/dev/log`.
The receiver can mostly parse both RFC3164 and RFC5424 messages and writes them as JSON formatted message.
The logs can be viewed via `talosctl logs syslogd`.

This is mostly implemented for extension services that log to syslog.

## Miscellaneous

### Kubernetes Upgrade

The [command](../../../kubernetes-guides/advanced-guides/upgrading-kubernetes) `talosctl upgrade-k8s` now supports specifying custom image references for Kubernetes components via `--*-image` flags.
The default behavior is unchanged, and the flags are optional.

### KubeSpan

Talos Linux disables by default a [KubeSpan](../networking/kubespan) feature to harvest additional endpoints from KubeSpan members.
This feature turned out to be less helpful than expected and caused unnecessary performance issues.

Previous behavior can be restored with:

```yaml theme={null}
machine:
  network:
    kubespan:
        harvestExtraEndpoints: true
```

### Secure Boot ISO

Talos Linux now provides a way to configure systemd-boot ISO 'secure-boot-enroll' option while [generating](../platform-specific-installations/boot-assets) a SecureBoot ISO image:

```yaml theme={null}
output:
    kind: iso
    isoOptions:
        sdBootEnrollKeys: force # default is still if-safe
    outFormat: raw
```

### Hardware Watchdog Timers

Talos Linux now supports [hardware watchdog timers](../build-and-extend-talos/cluster-operations-and-maintenance/watchdog) configuration.
If enabled, and the machine becomes unresponsive, the hardware watchdog will reset the machine.

The watchdog can be enabled with the following [configuration document](../reference/configuration/runtime/watchdogtimerconfig):

```yaml theme={null}
apiVersion: v1alpha1
kind: WatchdogTimerConfig
device: /dev/watchdog0
timeout: 3m0s
```

## Component Updates

* Linux: 6.6.28
* etcd: 3.5.11
* Kubernetes: 1.30.0
* containerd: 1.7.15
* runc: 1.1.12
* Flannel: 0.24.4

Talos is built with Go 1.22.2.