v1.3.0

Omni 1.3.0 (2025-11-07)

Welcome to the v1.3.0 release of Omni!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Shortened Auth0 Token Lifetime

Auth0 authentication tokens now expire after 2 minutes. Users without valid PGP keys will need to reauthenticate once tokens expire.

Cluster Import (Experimental)

Omni introduces an experimental feature that allows users to import existing Talos clusters to be managed by Omni.

Documentation on how to use this feature can be found here: https://docs.siderolabs.com/omni/cluster-management/importing-talos-clusters

Multi-Select for Pending Machines

You can now accept or reject multiple pending machines at once, simplifying large-scale approvals.

Stripe Link in Settings Sidebar

A Stripe link is now shown in the Omni settings sidebar when Stripe integration is enabled.

Display Unsupported Kubernetes Versions

Unsupported Kubernetes versions are now shown in the update modal as disabled entries with explanatory messages.

Improved Kubernetes Update Modal

The Kubernetes update modal now displays only upgradeable minor versions and explains why certain versions are not upgradeable.

Enhanced CPU Information in Machine Status

Machines now report processor details when either core count or frequency is available, improving visibility into hardware specs.

Support for Modifying Kernel Arguments

Omni now supports modifying kernel arguments for the existing machines.

Documentation on how to use this feature can be found here: https://docs.siderolabs.com/omni/infrastructure-and-extensions/modify-kernel-arguments

Contributors

• Edward Sammut Alessi
• Utku Ozdemir
• Artem Chernyshev
• Oguz Kilcan
• Andrey Smirnov
• Justin Garrison
• Noel Georgi
• niklasfrick
• niklasfrick

Changes

88 commits

• 3a47a7ee release(v1.3.0): prepare release
• 4b81c5e5 fix: remove KernelArgs resource when a machine is removed
• e51ef57a test: fix install extra kernel args in infra test
• 8a24c83d fix: update MachineRequestStatus resource when we populate UUID
• a3d47dae chore: expose enable-talos-pre-release-versions flag in the FeaturesConfig
• a1ab057b release(v1.3.0-beta.2): prepare release
• 13af8506 fix: prevent stale reads of kernel args in schematic id calculation
• a243fa88 fix(frontend): never add install disk for default disk
• af202c46 refactor(frontend): create a docs link generator
• 084e813a refactor(frontend): refactor tselectlist with reka-ui
• 0aba0fc7 fix(frontend): ignore invalid signature error on logout
• 516d2deb feat: permit MetaWrite/MetaDelete Talos APIs
• bacf80b5 refactor(frontend): introduce tw-animate-css
• 74a20773 release(v1.3.0-beta.1): prepare release
• 3f2021b0 fix(frontend): remove network error toasts
• 31d42130 fix: remove non-machinery Talos import, fix changelog
• bb582359 release(v1.3.0-beta.0): prepare release
• c2cbf34b fix: get rid of an extra call of the final provision step
• ff79e024 feat(installation-media): replace modal with link
• 8dde49d4 refactor(frontend): replace .prettierrc with prettier.config.ts
• 9d3ae445 chore(frontend): update node to latest lts
• a6da9dbf feat(installation-media): add placeholder steps
• afbc02f6 feat(installation-media): integrate stepper into create page
• 15deddde feat: implement extra kernel args support
• 832beba9 fix: change the order of operations in the common infra provider lib
• f70d78ee fix: make sidebar menus which do not open routes expand the submenus
• 52234c15 fix(frontend): add missing gap in some modals
• 0fa7d0a5 fix(frontend): only clamp min/max tinput values on blur
• 9794f6f0 fix(frontend): correct the icon colors on tstatus
• 02425267 test: improve integration tests
• a91eabdf fix: make sure that machine state is never nil in deprovision calls
• 4e120167 fix: properly check tracking state to show user consent form
• 25d58187 feat(installation-media): add initial page for creating installation media
• d9c41f11 feat(installation-media): add a stepper component
• 6d941f8a fix: remove https from URL in values frile for auth0
• df301c98 fix: make workload proxy cookies HTTP only
• 32f72f76 refactor(frontend): merge all sidebars into one sidebar
• 4490490d fix(frontend): hide sidebar during oidc auth
• c0e07b76 fix(frontend): fix sidebar children toggle behavior
• f997e541 feat(frontend): add a radio group component
• 3c139b23 chore(deps): update frontend deps
• ba821e93 chore(readme): clarify readme and add a comment in vite.config about allowedHosts
• 6e3019e2 feat: add new label style to tinput
• 20f6be0e fix: correctly fetch user ID for service accounts on the role edit page
• b5765d8d test: use bridge IP for WireGuard in CI
• 43ac1227 chore: add stories for tinput and cleanup
• d87574a4 feat(auth): make auth0 tokens only be valid for 2 minutes
• e60c8211 test: add more tests for the frontend API
• d0c8b166 chore: bump Talos to 1.11.3, reorder CI workflow jobs
• f28de89a fix: allow aborting kubernetes upgrades
• a4a91a96 fix: hide cancel button on minor kubernetes upgrades
• a7df08aa fix: honor lock status for machines during kubernetes upgrade
• eaa97c61 chore: move image package to client
• 2e77f37e fix(frontend): correctly set the size of the lock icon for clusters
• 90bd23a1 feat(frontend): create a generic table component
• 049ab877 chore: revert 'feat: add support for updating kernel args'
• 3139557b refactor: drop extra input finalizers
• 0d58ade7 feat: implement cluster import
• 6ffdae00 fix: remove debug code
• b2fbf900 feat(installation-media): add route for installation media page
• 4eee58fb feat(storybook): add ticon stories
• c57c89e8 refactor(tbutton): separate type and size styles in tbutton
• aaf45de0 refactor(routes): normalise /machine and /machines into /machines
• c88503dc chore: bump default Talos version, deps, rekres, re-generate
• a9986eab feat(frontend): clarify information inside update kubernetes modal
• 32a69827 feat(frontend): allow multi-select for pending machines
• ef6584f9 chore(frontend): update dependencies
• 6838947d feat(frontend): show unsupported k8s version in modal
• d27624ab chore: rekres and bump go to 1.25.2
• b8b3f356 feat: show cpus if they have cores or frequency
• ae9d7cca feat: add support for updating kernel args
• e380ea45 fix: typo in Helm chart readme service name for API Ingress example
• af3eeaf4 feat(frontend): add stripe link to settings sidebar
• ef84a4ca refactor: use TalosVersion compatibility in Kubernetes upgrades
• 3675826e fix(frontend): resize cluster machines correctly during deletion
• 3cff7a60 fix: update WireGuard wording to SideroLink
• a6562dc2 fix(frontend): fix alignment of provisioning machines
• 543f831f chore(storybook): write a story for clusters page
• 18a8f0b0 feat(frontend): add a skip parameter to skip watch dynamically
• 3d0d0cf6 fix(frontend): fix locked icon not showing when cluster is locked
• 626e6e26 refactor(msw): simplify msw handlers in storybook
• ffd695fb fix: remove dangling cluster taints
• 66c7d43a refactor(checkbox): change t-checkbox to use v-model
• cf9c93f7 feat: introduce storybook for omni frontend
• f1a0ce72 chore: bump min Talos version
• c91bd784 refactor(frontend): use auth flow constants
• 2965a614 chore(ci): sops update keys
• 12a0a6e4 chore(frontend): update dependencies

Changes since v1.3.0-beta.2

5 commits

• 3a47a7ee release(v1.3.0): prepare release
• 4b81c5e5 fix: remove KernelArgs resource when a machine is removed
• e51ef57a test: fix install extra kernel args in infra test
• 8a24c83d fix: update MachineRequestStatus resource when we populate UUID
• a3d47dae chore: expose enable-talos-pre-release-versions flag in the FeaturesConfig

Changes from siderolabs/crypto

2 commits

• 4154a77 feat: implement dynamic certificate reloader
• dae07fa chore: update to Go 1.25

Changes from siderolabs/go-api-signature

2 commits

• 876da9a feat: add method for revoking public key
• 184f94d chore: rekres and bump go to 1.25.2

Changes from siderolabs/go-debug

1 commit

• d51e25a chore: rekres, bump deps and go

Dependency Changes

• github.com/aws/aws-sdk-go-v2 v1.39.0 -> v1.39.3
• github.com/aws/aws-sdk-go-v2/config v1.31.8 -> v1.31.12
• github.com/aws/aws-sdk-go-v2/credentials v1.18.12 -> v1.18.16
• github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.19.6 -> v1.19.12
• github.com/aws/aws-sdk-go-v2/service/s3 v1.88.1 -> v1.88.4
• github.com/aws/smithy-go v1.23.0 -> v1.23.1
• github.com/coreos/go-oidc/v3 v3.15.0 -> v3.16.0
• github.com/emicklei/dot v1.9.1 -> v1.9.2
• github.com/go-jose/go-jose/v4 v4.1.2 -> v4.1.3
• github.com/go-playground/validator/v10 v10.27.0 -> v10.28.0
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 -> v2.27.3
• github.com/hashicorp/vault/api v1.21.0 -> v1.22.0
• github.com/johannesboyne/gofakes3 6555d310c473 -> ebf3e50324d3
• github.com/prometheus/common v0.66.1 -> v0.67.1
• github.com/siderolabs/crypto v0.6.3 -> v0.6.4
• github.com/siderolabs/go-api-signature v0.3.8 -> v0.3.10
• github.com/siderolabs/go-debug v0.6.0 -> v0.6.1
• github.com/siderolabs/omni/client v1.1.2 -> v1.2.1
• github.com/siderolabs/talos/pkg/machinery v1.11.1 -> v1.12.0-alpha.2
• github.com/zitadel/oidc/v3 v3.44.0 -> v3.45.0
• go.etcd.io/etcd/client/pkg/v3 v3.6.4 -> v3.6.5
• go.etcd.io/etcd/client/v3 v3.6.4 -> v3.6.5
• go.etcd.io/etcd/server/v3 v3.6.4 -> v3.6.5
• golang.org/x/crypto v0.42.0 -> v0.43.0
• golang.org/x/net v0.44.0 -> v0.46.0
• golang.org/x/oauth2 v0.31.0 -> v0.32.0
• golang.org/x/text v0.29.0 -> v0.30.0
• golang.org/x/time v0.13.0 -> v0.14.0
• golang.org/x/tools v0.37.0 -> v0.38.0
• google.golang.org/grpc v1.75.1 -> v1.76.0
• google.golang.org/protobuf v1.36.9 -> v1.36.10
• k8s.io/api v0.35.0-alpha.0 -> v0.35.0-alpha.1
• k8s.io/apimachinery v0.35.0-alpha.0 -> v0.35.0-alpha.1
• k8s.io/client-go v0.35.0-alpha.0 -> v0.35.0-alpha.1
• sigs.k8s.io/controller-runtime v0.22.1 -> v0.22.3

Previous release can be found at v1.2.0