chore(talos): move to v1.12.11 and add i915 to the schematic #634

2026-08-26T16:34:06Z

claude-bot commented

2026-08-26 16:34:06 +00:00

Nodes run v1.12.6; v1.12.11 is the last patch of the 1.12 series. Upstream tests migration only between adjacent minors and recommends going to the latest patch of each intermediate minor, so this is the required stop before 1.13, not an optional one.

Extensions. Adds siderolabs/i915 while the image is rebuilt anyway. Nothing requests /dev/dri today — every manifest was checked, the only devices any workload asks for are Ceph RBD and the NVMe disks by-id. Included for the reason thunderbolt already is: the extension set is fixed at install and upgrade time, so adding it later means another rolling upgrade of all three nodes rather than a config change.

New schematic 0f6fb8bd… = a21cec8f… + i915. Registered with the Image Factory; the resulting installer image verified to exist for v1.12.11.

Absences are deliberate and now documented so they are not re-derived as gaps: X710 (i40e) and I226 (igc) need no firmware extension — intel-ice-firmware covers E810/ice only; mei is a prerequisite for Intel Arc discrete GPUs and there are none; iscsi-tools/nvme-cli/util-linux-tools have no consumer, since storage is Ceph RBD and device health comes from Ceph rather than a node-level exporter.

Applying this matters separately. talosctl upgrade --image does not write .machine.install.image. That is how the running nodes ended up on ghcr.io/siderolabs/installer:v1.12.6 despite this file naming a Factory image — and why talosctl get extensions is empty on all three. The config has to be applied, not just the upgrade run.

Kubernetes is untouched — talosctl upgrade does not move it. Stays on v1.35.2; upgrade-k8s is a separate step.

Rollout plan agreed: k8s-1 first, verify Ready + Ceph HEALTH_OK + extensions present, then report before touching k8s-2/3.

Not applied to any node yet.

Nodes run **v1.12.6**; **v1.12.11** is the last patch of the 1.12 series. Upstream tests migration only between adjacent minors and recommends going to the latest patch of each intermediate minor, so this is the required stop before 1.13, not an optional one. **Extensions.** Adds `siderolabs/i915` while the image is rebuilt anyway. Nothing requests `/dev/dri` today — every manifest was checked, the only devices any workload asks for are Ceph RBD and the NVMe disks by-id. Included for the reason `thunderbolt` already is: the extension set is fixed at install and upgrade time, so adding it later means another rolling upgrade of all three nodes rather than a config change. New schematic `0f6fb8bd…` = `a21cec8f…` + i915. Registered with the Image Factory; the resulting installer image verified to exist for v1.12.11. Absences are deliberate and now documented so they are not re-derived as gaps: X710 (`i40e`) and I226 (`igc`) need no firmware extension — `intel-ice-firmware` covers E810/`ice` only; `mei` is a prerequisite for Intel Arc discrete GPUs and there are none; `iscsi-tools`/`nvme-cli`/`util-linux-tools` have no consumer, since storage is Ceph RBD and device health comes from Ceph rather than a node-level exporter. **Applying this matters separately.** `talosctl upgrade --image` does *not* write `.machine.install.image`. That is how the running nodes ended up on `ghcr.io/siderolabs/installer:v1.12.6` despite this file naming a Factory image — and why `talosctl get extensions` is empty on all three. The config has to be applied, not just the upgrade run. Kubernetes is untouched — `talosctl upgrade` does not move it. Stays on v1.35.2; `upgrade-k8s` is a separate step. **Rollout plan agreed:** k8s-1 first, verify Ready + Ceph `HEALTH_OK` + extensions present, then report before touching k8s-2/3. Not applied to any node yet.

claude-bot added 1 commit 2026-08-26 16:34:06 +00:00

chore(talos): move to v1.12.11 and add i915 to the schematic

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

d505503616

The nodes run v1.12.6; v1.12.11 is the last patch of the 1.12 series. Upstream
tests migration only between adjacent minors and recommends going to the latest
patch of each intermediate minor, so 1.12.11 is the required stop before 1.13,
not an optional one.

Adds siderolabs/i915 while the image is being rebuilt anyway. Nothing requests
/dev/dri today — every manifest was checked, the only devices any workload asks
for are Ceph RBD and the NVMe disks by-id. It is included for the reason
thunderbolt already is: the extension set is fixed at install and upgrade time,
so adding it later would mean another rolling upgrade of all three nodes rather
than a config change. The MS-01's Alder Lake-P Iris Xe is present in hardware
either way.

New schematic 0f6fb8bd…, identical to a21cec8f… plus i915. Registered with the
Image Factory and the resulting installer image verified to exist for v1.12.11.

The absences are deliberate and now written down, so they are not re-derived as
gaps later: the X710 (i40e) and I226 (igc) NICs need no firmware extension —
intel-ice-firmware covers E810/ice only; mei is a prerequisite for Intel Arc
discrete GPUs and there are none; iscsi-tools, nvme-cli and util-linux-tools
have no consumer, since storage is Ceph RBD and device health comes from Ceph
rather than a node-level exporter.

Both runbooks move to the new schematic and version.

Note for whoever applies this: talosctl upgrade --image does NOT write
.machine.install.image, so this config has to be applied separately or the node
keeps pointing at whatever it was installed with. That is how the running nodes
ended up on ghcr.io/siderolabs/installer:v1.12.6 despite this file naming a
Factory image — which is also why talosctl get extensions is empty on all
three.

Kubernetes is untouched; talosctl upgrade does not move it. It stays on v1.35.2
and is a separate upgrade-k8s step.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

review-bot reviewed

2026-08-26 16:36:43 +00:00

review-bot left a comment

🤖 Automated review — model claude-haiku-4-5-20251001 (complexity: trivial), commit d505503616b8dc3eb7a5111b71427c5ca0473420.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This PR updates the Talos cluster from v1.12.6 to v1.12.11 (the final patch of the 1.12 series) and adds the i915 GPU extension to the schematic. The configuration changes are consistent across all three modified files: the new schematic hash 0f6fb8bd… and version v1.12.11 are correctly referenced in both runbooks and the cluster patch. The PR includes clear documentation of design decisions about included and excluded extensions. No blocking issues found.

🟡 Suggestions

1. ci/images/k8s/Containerfile — talosctl version mismatch

ci/images/k8s/Containerfile:3 still specifies TALOS_VERSION=v1.12.6, while the cluster is being upgraded to v1.12.11. Although talosctl v1.12.6 should generally be compatible with Talos v1.12.11 (both are in the 1.12 series), best practice is to keep talosctl version in sync with the cluster version to avoid unexpected compatibility issues. Update this to v1.12.11.

2. kubernetes/RUNBOOK-cold-rebuild.md — incomplete documentation update

kubernetes/RUNBOOK-cold-rebuild.md:93-104 describes how the bare-metal schematic "differs in three ways" from the Proxmox one, listing intel-ucode, thunderbolt, and qemu-guest-agent. With i915 now added to the schematic, this documentation should be updated to say "differs in four ways" and include i915 in the list, for consistency with the new reality.

Tests

This is a configuration/documentation change only — no code logic to test. The actual upgrade is manual and not yet applied ("Not applied to any node yet" per the PR body). The claim that the schematic 0f6fb8bd… has been registered with the Image Factory and verified to exist for v1.12.11 is documented but not independently verifiable from the repo alone.

Recommendation

Looks reasonable with non-blocking suggestions — address the two points above (talosctl version in Containerfile and the RUNBOOK documentation) before merging to keep the configuration consistent across the repository.

🤖 **Automated review** — model `claude-haiku-4-5-20251001` (complexity: trivial), commit `d505503616b8dc3eb7a5111b71427c5ca0473420`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR updates the Talos cluster from v1.12.6 to v1.12.11 (the final patch of the 1.12 series) and adds the i915 GPU extension to the schematic. The configuration changes are consistent across all three modified files: the new schematic hash `0f6fb8bd…` and version v1.12.11 are correctly referenced in both runbooks and the cluster patch. The PR includes clear documentation of design decisions about included and excluded extensions. No blocking issues found. ## 🟡 Suggestions ### 1. ci/images/k8s/Containerfile — talosctl version mismatch **ci/images/k8s/Containerfile:3** still specifies `TALOS_VERSION=v1.12.6`, while the cluster is being upgraded to v1.12.11. Although talosctl v1.12.6 should generally be compatible with Talos v1.12.11 (both are in the 1.12 series), best practice is to keep talosctl version in sync with the cluster version to avoid unexpected compatibility issues. Update this to `v1.12.11`. ### 2. kubernetes/RUNBOOK-cold-rebuild.md — incomplete documentation update **kubernetes/RUNBOOK-cold-rebuild.md:93-104** describes how the bare-metal schematic "differs in three ways" from the Proxmox one, listing intel-ucode, thunderbolt, and qemu-guest-agent. With i915 now added to the schematic, this documentation should be updated to say "differs in four ways" and include i915 in the list, for consistency with the new reality. ## Tests This is a configuration/documentation change only — no code logic to test. The actual upgrade is manual and not yet applied (`"Not applied to any node yet"` per the PR body). The claim that the schematic `0f6fb8bd…` has been registered with the Image Factory and verified to exist for v1.12.11 is documented but not independently verifiable from the repo alone. ## Recommendation Looks reasonable with non-blocking suggestions — address the two points above (talosctl version in Containerfile and the RUNBOOK documentation) before merging to keep the configuration consistent across the repository.

k.renner merged commit 6716f7dc50 into master

2026-08-26 16:44:36 +00:00

k.renner referenced this issue from a commit

2026-08-26 16:44:37 +00:00

Merge pull request 'chore(talos): move to v1.12.11 and add i915 to the schematic' (#634) from talos-1-12-11 into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#634