backports: for v1.13.9 - #14060
Open
smira wants to merge 6 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR aggregates backports targeted for the v1.13.9 line, combining runtime fixes (nftables netlink buffering, extension IPC namespace behavior, and try-mode config apply robustness) with the usual release/version bumps (kernel/Go versions, tool images, and Go module dependencies).
Changes:
- Size nftables netlink send/receive buffers and reuse a lasting netlink connection per controller run; add a regression test for large rulesets.
- Run extension services in the host IPC namespace and handle
SetConfig(nil)by deleting the machine config resource; add an integration regression test for try-mode apply without prior config. - Bump kernel/Go version strings and update tools/pkgs image tags and various Go module dependencies.
Reviewed changes
Copilot reviewed 14 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/structprotogen/go.sum | Updates x/* dependency sums for structprotogen tool module. |
| tools/structprotogen/go.mod | Bumps golang.org/x/* dependencies for structprotogen. |
| tools/redactgen/go.sum | Updates x/* dependency sums for redactgen tool module. |
| tools/redactgen/go.mod | Bumps golang.org/x/* dependencies for redactgen. |
| tools/go.sum | Updates toolchain dependency sums for the tools module. |
| tools/go.mod | Bumps tools module Go version and indirect x/* dependencies. |
| pkg/machinery/gendata/data/tools | Updates embedded tools image tag metadata. |
| pkg/machinery/gendata/data/pkgs | Updates embedded pkgs image tag metadata. |
| pkg/machinery/constants/constants.go | Bumps default kernel version and reported Go build version. |
| Makefile | Updates TOOLS/PKGS image tags used in builds. |
| internal/integration/provision/maintenance_basic.go | Adds integration regression coverage for try-mode apply with no prior config. |
| internal/app/machined/pkg/system/services/extension.go | Shares host IPC namespace with extension service containers. |
| internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go | Allows SetConfig(nil) by destroying the config resource instead of panicking. |
| internal/app/machined/pkg/controllers/network/nftables_chain.go | Sizes nftables netlink socket buffers and reuses a lasting connection. |
| internal/app/machined/pkg/controllers/network/nftables_chain_test.go | Adds a large ruleset regression test to validate buffering fix. |
| hack/release.toml | Updates release note component versions (and Go version text). |
| go.sum | Updates root module dependency sums (x/* bumps). |
| go.mod | Bumps root module dependencies (x/* bumps). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
dsseng
approved these changes
Aug 17, 2026
smira
force-pushed
the
backports/v1.13.9
branch
2 times, most recently
from
August 17, 2026 17:47
bb1a752 to
940a6b0
Compare
smira
added
integration/release-gate
smira
force-pushed
the
backports/v1.13.9
branch
from
August 18, 2026 07:02
940a6b0 to
01e0c7d
Compare
shanduur
approved these changes
Aug 18, 2026
smira
added
integration/provision-2
smira
force-pushed
the
backports/v1.13.9
branch
from
August 18, 2026 10:59
01e0c7d to
7b3a614
Compare
Also pull in new Linux & pkgs. Update dependencies to clear Grype report. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Without this fix, kernel default send/receive buffers are used which might not be enough, as the full transaction of replacing the firewall is atomic, and basically we need to send (and then receive ACKs) for every piece of the firewall. Provide proper sizing for send/receive buffers. Also, create one connection per controller run and use that. Fixes siderolabs#14001 Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 87bfa70)
There is an interaction between multipath-tools, devicemapper and udevd which sometimes crosses the extension service and the host when used via CSI. Allow to share IPC namespace so that the SysV locks works across the boundary of the extension service. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 1c50b73)
Without this fix, Talos panics while trying to set the config to `nil` value. This is an edge case specifically for naving no machine config prior to the requested try operation. Add a regression test in the maintenance test. Fixes siderolabs#14044 Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit be6b963)
Persist them on disk for GHA to pick them up. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Use the latest Kubernetes. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
smira
force-pushed
the
backports/v1.13.9
branch
from
August 18, 2026 12:29
7b3a614 to
9ade215
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PRs backported: