v1.1.0-beta.0

Omni 1.1.0-beta.0 (2025-08-25)

Welcome to the v1.1.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Improved Clusters Page Breadcrumbs

Breadcrumbs on the clusters page have been redesigned for better navigation.

CLI Support for Kernel Args and Join Configs

omnictl now supports commands to retrieve SideroLink kernel arguments and join configurations.

Default Config Location Change

The default location for storing Omni configuration files and user PGP keys has been changed.

Custom Volumes in Helm Chart

Added support for specifying custom volumes and volume mounts in the Omni Helm chart.

Join Token Usage Warning

Omni now warns users when a join token is currently in use during revoke or delete operations.

Collapsible Sidebar on Mobile

The sidebar can now be collapsed when viewed on mobile devices, improving usability on smaller screens.

Join Tokens CLI

A new CLI feature has been added to manage SideroLink join tokens directly using omnictl.

Unique Token Status per Node

Omni now computes and displays a unique join token status for each node.

Contributors

• Andrey Smirnov
• Edward Sammut Alessi
• Oguz Kilcan
• Mateusz Urbanek
• Artem Chernyshev
• Noel Georgi
• Thomas Gosteli
• Utku Ozdemir

Changes

36 commits

• 98d2e409 release(v1.1.0-beta.0): prepare release
• 9daa2fa2 chore: create a useWatch composable
• 7ae7ea74 chore: rekres, bump deps, Go, satisfy linters
• 152db8fe feat: change default location for storing Omni config and user PGP keys
• 36430a26 feat: add custom volume and custom volume mount support for omni helm chart
• 150d61bf fix: better detect user identity in SAML responses
• 80a572fa chore: normalise font styles
• 82eba18b chore: update frontend dependencies
• 12a1d4d5 feat: make sidebar collapsible on mobile
• e108fb1c feat: support commands for getting kernel args and join configs in CLI
• 45a9d8c2 chore: types for route.meta.sidebar & title
• 110d551c chore: tailwind v4 upgrade
• 13d83648 chore: prepare omni for talos v1.11.0-beta.2
• 270eabf1 chore: commit vscode settings for frontend
• f264f1d1 fix: incorrect disabled icon color
• a268b8fd test: fix asserting etcd members test
• 69c4fd5d fix: prevent service account creation if name is already in use
• fe5d0280 feat: warn user about join token being in use during revoke/delete
• 73e42222 chore: more lint & formatting rules for omni/frontend
• 7e032266 chore: ts, lint, and formatting rules for omni frontend
• 928b7d89 test: fix omni upgrade e2e test
• 8e4f86f9 feat: rework breadcrumbs for clusters page
• 9521b302 chore: switch from bun to node
• 229e0060 fix: keep control plane status up to date
• 3f35ef23 chore: remove unused .eslintrc.yaml config
• 025c37f2 fix: stop enforcing talos version check on machine allocation
• c3b4f021 chore: rekres, bump talos and k8s versions
• 7e59f1ce fix: install frontend dependencies from lockfile
• 746c9662 chore: rekres to use correct slack channel for slack-notify
• 5047a625 feat: compute unique token status for each node
• e740c8b7 test: fix registry mirror config format in integration tests
• 0591d2ee feat: implement join token management CLI
• 4b0c32aa fix: remove MachineLabels when a Link is removed
• 9ac5cf4f fix: properly handle empty configs in omnictl config merge CLI command
• 0fc13bbf test: run Omni upgrade tests against latest stable
• 88f51163 chore: run inspector in the dev docker-compose

Changes from siderolabs/discovery-client

3 commits

• 0bffa6f fix: allow TLS config to be passed as a function
• 09c6687 chore: fix project name in release.toml
• 71b0c6d fix: add FIPS-140-3 strict compliance

Changes from siderolabs/discovery-service

2 commits

• d186f97 release(v1.10.11): prepare release
• 01e232a fix: pull in new client for FIPS-140-3 compliance

Changes from siderolabs/gen

1 commit

• 044d921 feat: add xslices.Deduplicate

Changes from siderolabs/go-api-signature

2 commits

• d22e33d feat: clarify fallback logic for fallback capable key provider
• dea3048 feat: allow configuring the provider with fallback location

Changes from siderolabs/go-debug

1 commit

• e21721b chore: add support for Go 1.25

Changes from siderolabs/go-kubernetes

2 commits

• 7887034 feat: add checks for Kubernetes 1.34 removals
• 657a74b feat: prepare for Kubernetes 1.34

Changes from siderolabs/image-factory

33 commits

• 57ad419 release(v0.8.1): prepare release
• 6392086 fix: prevent failure on cache.Get
• a1e3707 feat: add fallback if S3 is missbehaving
• 9760ab0 release(v0.8.0): prepare release
• [7c6d261](siderolabs/image-factory@7c6d...

v1.0.1

Omni 1.0.1 (2025-08-12)

Welcome to the v1.0.1 release of Omni!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Contributors

• Oguz Kilcan

Changes

9 commits

• e0605b9d release(v1.0.1): prepare release
• 353f0cab test: fix asserting etcd members test
• f42a94a6 fix: prevent service account creation if name is already in use
• f8ad61f0 test: fix omni upgrade e2e test
• 562bd58d test: run Omni upgrade tests against latest stable
• 092a0462 chore: allow more than one commit for a PR
• a221ba61 fix: keep control plane status up to date
• c6c8da2b fix: install frontend dependencies from lockfile
• 898f83d3 test: fix registry mirror config format in integration tests

Dependency Changes

This release has no dependency changes

Previous release can be found at v1.0.0

v1.0.0

Omni 1.0.0 (2025-07-25)

Welcome to the v1.0.0 release of Omni!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Multiple Join Token Support

Omni now supports multiple SideroLink join tokens.
It now creates the default non-expiring token, then the user can create more tokens and delete the old ones.

Config Change History

There is now MachineConfigDiffs.omni.sidero.dev resource that keeps the history of
each machine config change.
It keeps up to 1000 diffs for the last 30 days.

Contributors

• Artem Chernyshev
• Andrey Smirnov
• Utku Ozdemir
• Oguz Kilcan
• Mateusz Urbanek

Changes

23 commits

• 8bf87c12 release(v1.0.0): prepare release
• 781a04e1 chore: extract node unique token to the separate resource
• de7d90b7 test: allow ignoring unknown config fields in the integration test
• c761e347 release(v1.0.0-beta.1): prepare release
• 28158ed8 fix: ignore MachineStatus having no TalosVersion in DNS service
• da3f28f6 chore: support encoding extra docs in siderolink.RenderJoinConfig
• f4582116 fix: allow encoding join tokens using v1 version
• 80ff037a fix: do not try to encode v1/v2 tokens in siderolink.NewJoinToken
• 7b7c021d fix: do not create JoinTokenUsage for PendingMachines
• 2c4f34a7 fix: fix etcd status check in control plane status
• b0f76343 feat: implement the API for reading resources and their dependency graph
• e945cc7b release(v1.0.0-beta.0): prepare release
• a2722856 chore: enable gRPC keepalive in the Omni client
• f8de9a6d feat: add support for imported cluster secrets
• 753259c2 fix: do not filter out noop events in the infra provider state
• ab1f7cc7 feat: implement multiple token support and token management
• 0e76483b chore: rekres, bump deps, Go, Talos and k8s versions, satisfy linters
• e1c1aaea fix: add validation of k8s version
• f1b47f08 feat: log and store redacted machine config diffs
• a7ac6372 chore: rewrite join config generation
• 66c7897b chore: update zstd module go.mod deps
• 3b701483 test: reduce the log verbosity in unit tests
• ff32ae4c fix: gracefully handle logServer shutdown

Changes since v1.0.0-beta.1

3 commits

• 8bf87c12 release(v1.0.0): prepare release
• 781a04e1 chore: extract node unique token to the separate resource
• de7d90b7 test: allow ignoring unknown config fields in the integration test

Changes from siderolabs/crypto

5 commits

• 62a079b fix: update TLS config, add tests for TLS interactions
• c2b4e26 fix: remove code duplication and fix Ed255119 CA generation
• 2a07632 fix: enforce FIPS-140-3 compliance
• 17107ae fix: add generic CSR generator and OpenSSL interop
• 53659fc refactor: split into files

Dependency Changes

• github.com/cosi-project/runtime v0.10.5 -> v0.10.6
• github.com/siderolabs/crypto v0.5.1 -> v0.6.3
• github.com/siderolabs/talos/pkg/machinery v1.10.1 -> da5a4449f1a9
• google.golang.org/grpc v1.72.0 -> v1.73.0

Previous release can be found at v0.52.0

v1.0.0-beta.1

Omni 1.0.0-beta.1 (2025-07-24)

Welcome to the v1.0.0-beta.1 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Multiple Join Token Support

Omni now supports multiple SideroLink join tokens.
It now creates the default non-expiring token, then the user can create more tokens and delete the old ones.

Config Change History

There is now MachineConfigDiffs.omni.sidero.dev resource that keeps the history of
each machine config changes.
It keeps up to 1000 diffs for the last 30 days.

Contributors

• Artem Chernyshev
• Andrey Smirnov
• Utku Ozdemir
• Oguz Kilcan
• Mateusz Urbanek

Changes

20 commits

• c761e347 release(v1.0.0-beta.1): prepare release
• 28158ed8 fix: ignore MachineStatus having no TalosVersion in DNS service
• da3f28f6 chore: support encoding extra docs in siderolink.RenderJoinConfig
• f4582116 fix: allow encoding join tokens using v1 version
• 80ff037a fix: do not try to encode v1/v2 tokens in siderolink.NewJoinToken
• 7b7c021d fix: do not create JoinTokenUsage for PendingMachines
• 2c4f34a7 fix: fix etcd status check in control plane status
• b0f76343 feat: implement the API for reading resources and their dependency graph
• e945cc7b release(v1.0.0-beta.0): prepare release
• a2722856 chore: enable gRPC keepalive in the Omni client
• f8de9a6d feat: add support for imported cluster secrets
• 753259c2 fix: do not filter out noop events in the infra provider state
• ab1f7cc7 feat: implement multiple token support and token management
• 0e76483b chore: rekres, bump deps, Go, Talos and k8s versions, satisfy linters
• e1c1aaea fix: add validation of k8s version
• f1b47f08 feat: log and store redacted machine config diffs
• a7ac6372 chore: rewrite join config generation
• 66c7897b chore: update zstd module go.mod deps
• 3b701483 test: reduce the log verbosity in unit tests
• ff32ae4c fix: gracefully handle logServer shutdown

Changes since v1.0.0-beta.0

8 commits

• c761e347 release(v1.0.0-beta.1): prepare release
• 28158ed8 fix: ignore MachineStatus having no TalosVersion in DNS service
• da3f28f6 chore: support encoding extra docs in siderolink.RenderJoinConfig
• f4582116 fix: allow encoding join tokens using v1 version
• 80ff037a fix: do not try to encode v1/v2 tokens in siderolink.NewJoinToken
• 7b7c021d fix: do not create JoinTokenUsage for PendingMachines
• 2c4f34a7 fix: fix etcd status check in control plane status
• b0f76343 feat: implement the API for reading resources and their dependency graph

Changes from siderolabs/crypto

5 commits

• 62a079b fix: update TLS config, add tests for TLS interactions
• c2b4e26 fix: remove code duplication and fix Ed255119 CA generation
• 2a07632 fix: enforce FIPS-140-3 compliance
• 17107ae fix: add generic CSR generator and OpenSSL interop
• 53659fc refactor: split into files

Dependency Changes

• github.com/cosi-project/runtime v0.10.5 -> v0.10.6
• github.com/siderolabs/crypto v0.5.1 -> v0.6.3
• github.com/siderolabs/talos/pkg/machinery v1.10.1 -> da5a4449f1a9
• google.golang.org/grpc v1.72.0 -> v1.73.0

Previous release can be found at v0.52.0

v1.0.0-beta.0

Omni 1.0.0-beta.0 (2025-07-21)

Welcome to the v1.0.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Multiple Join Token Support

Omni now supports multiple SideroLink join tokens.
It now creates the default non-expiring token, then the user can create more tokens and delete the old ones.

Config Change History

There is now MachineConfigDiffs.omni.sidero.dev resource that keeps the history of
each machine config changes.
It keeps up to 1000 diffs for the last 30 days.

Contributors

• Andrey Smirnov
• Artem Chernyshev
• Utku Ozdemir
• Oguz Kilcan
• Mateusz Urbanek

Changes

12 commits

• e945cc7b release(v1.0.0-beta.0): prepare release
• a2722856 chore: enable gRPC keepalive in the Omni client
• f8de9a6d feat: add support for imported cluster secrets
• 753259c2 fix: do not filter out noop events in the infra provider state
• ab1f7cc7 feat: implement multiple token support and token management
• 0e76483b chore: rekres, bump deps, Go, Talos and k8s versions, satisfy linters
• e1c1aaea fix: add validation of k8s version
• f1b47f08 feat: log and store redacted machine config diffs
• a7ac6372 chore: rewrite join config generation
• 66c7897b chore: update zstd module go.mod deps
• 3b701483 test: reduce the log verbosity in unit tests
• ff32ae4c fix: gracefully handle logServer shutdown

Changes from siderolabs/crypto

5 commits

• 62a079b fix: update TLS config, add tests for TLS interactions
• c2b4e26 fix: remove code duplication and fix Ed255119 CA generation
• 2a07632 fix: enforce FIPS-140-3 compliance
• 17107ae fix: add generic CSR generator and OpenSSL interop
• 53659fc refactor: split into files

Dependency Changes

• github.com/cosi-project/runtime v0.10.5 -> v0.10.6
• github.com/siderolabs/crypto v0.5.1 -> v0.6.3
• github.com/siderolabs/talos/pkg/machinery v1.10.1 -> da5a4449f1a9
• google.golang.org/grpc v1.72.0 -> v1.73.0

Previous release can be found at v0.52.0

v0.52.0

Omni 0.52.0 (2025-07-08)

Welcome to the v0.52.0 release of Omni!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Support Fusion Auth

Fusion Auth provider is now supported via SAML.
Additional parameter --auth-saml-name-id-format must be set to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.

Infra Providers Request ID

Infra providers can now be configured to encode MachineRequest ID into the join token.
With that enabled setting the machine UUID in the MachineRequestStatus is no longer required in the provider:
Omni will automatically map the MachineRequest ID to the node UUID and will populate the field in the status.

This change is useful in the infra providers where it's impossible to get the created machine UUID.

Allow talosctl wipe disk Command

talosctl wipe disk can now be used with Omni managed nodes.
Omni will impersonate os:admin role for it if the user has write access to the cluster.

Contributors

• Artem Chernyshev
• Utku Ozdemir
• Orzelius

Changes

15 commits

• 1266560 release(v0.52.0): prepare release
• 438551c release(v0.52.0-beta.0): prepare release
• e1d4749 feat: allow talosctl wipe disk command
• 877b379 fix: update SAML library to the forked version with the ACS parser fix
• b1225c9 feat: support setting custom name ID format in SAML metadata
• c60820f fix: correctly detect installation status for bare-metal machines
• 344d061 feat: allow encoding the machine request ID into the join tokens
• a7fe525 test: test updating from old Omni version to the current
• abfe93c docs: add guide for development on darwin
• 0ad0a67 test: save a support bundle when a test suite has failed
• 9e4f819 fix: make sure clipped req/resp content logs are still valid JSONs
• 1c30730 feat: show the actual node name in the node overview breadcrumbs
• c097b5f fix: do not try running debug server in the prod builds
• 8a93c2d refactor: bring back the reverted new workload proxy dialing logic
• 122b796 test: run Omni as part of integration tests

Changes since v0.52.0-beta.0

1 commit

• 1266560 release(v0.52.0): prepare release

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.51.0

v0.52.0-beta.0

Omni 0.52.0-beta.0 (2025-07-07)

Welcome to the v0.52.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Support Fusion Auth

Fusion Auth provider is now supported via SAML.
Additional parameter --auth-saml-name-id-format must be set to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.

Infra Providers Request ID

Infra providers can now be configured to encode MachineRequest ID into the join token.
With that enabled setting the machine UUID in the MachineRequestStatus is no longer required in the provider:
Omni will automatically map the MachineRequest ID to the node UUID and will populate the field in the status.

This change is useful in the infra providers where it's impossible to get the created machine UUID.

Allow talosctl wipe disk Command

talosctl wipe disk can now be used with Omni managed nodes.
Omni will impersonate os:admin role for it if the user has write access to the cluster.

Contributors

• Artem Chernyshev
• Utku Ozdemir
• Orzelius

Changes

14 commits

• 438551c release(v0.52.0-beta.0): prepare release
• e1d4749 feat: allow talosctl wipe disk command
• 877b379 fix: update SAML library to the forked version with the ACS parser fix
• b1225c9 feat: support setting custom name ID format in SAML metadata
• c60820f fix: correctly detect installation status for bare-metal machines
• 344d061 feat: allow encoding the machine request ID into the join tokens
• a7fe525 test: test updating from old Omni version to the current
• abfe93c docs: add guide for development on darwin
• 0ad0a67 test: save a support bundle when a test suite has failed
• 9e4f819 fix: make sure clipped req/resp content logs are still valid JSONs
• 1c30730 feat: show the actual node name in the node overview breadcrumbs
• c097b5f fix: do not try running debug server in the prod builds
• 8a93c2d refactor: bring back the reverted new workload proxy dialing logic
• 122b796 test: run Omni as part of integration tests

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.51.0

v0.51.0

Omni 0.51.0 (2025-06-18)

Welcome to the v0.51.0 release of Omni!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Omni can now be configured using YAML configuration file in addition to the command line flags.
The parameter --config-file can be used for that. Any command line flags have higher priority.

Contributors

• Utku Ozdemir
• Artem Chernyshev
• Andrew Rynhard
• Andrey Smirnov

Changes

25 commits

• 34c61b7 release(v0.51.0): prepare release
• a36d357 release(v0.51.0-beta.2): prepare release
• 493d00c fix: properly support --config-path argument
• 742faec fix: do not mark SAML and Auth0 config sections as mutually exclusive
• de86c74 release(v0.51.0-beta.1): prepare release
• 4b40dc1 fix: do more fixes on config backward-compatibility
• 3085c3f fix: remove required config validation from k8s proxy cert and key
• bf6c38a release(v0.51.0-beta.0): prepare release
• 7a815ba fix: prevent zero machine count reports on controller shutdown
• 33e796e chore: rekres, bump Go to 1.24.4, SideroLink to v0.3.15
• f3cec18 fix: fix exposed service prefix conflict resolution
• 5e4c10b fix: use 0.0.0.0:8095 as the default bind endpoint for Kubernetes
• ccd55cc feat: rewrite Omni config management
• 05aad4d fix: check config patch creation time as well as updated on orphan check
• f3783ed fix: display unknown power state correctly on the machines screen
• 7c19c31 test: improve workload proxying tests
• c9c4c8e test: use go test to build and run Omni integration tests
• df5a2b9 fix: bump inmem COSI state history capacity
• aa5d89d fix: fix panic in maintenance upgrade
• 404bbd9 chore: allow running Omni programmatically from other Go code
• 9846622 fix: fix nil dereference in machine status controller
• 13bb8b5 docs: update SECURITY.md
• 178d2ad fix: make sure powering on stage is correctly set on infra machines
• e5d1b4b fix: properly detect infra provider service accounts
• d88bb1d test: use latest Talemu infra provider version in the integration tests

Changes since v0.51.0-beta.2

1 commit

• 34c61b7 release(v0.51.0): prepare release

Changes from siderolabs/gen

3 commits

• dcb2b74 feat: add panicsafe package
• b36ee43 feat: make xyaml.CheckUnknownKeys public
• 3e319e7 feat: implement xyaml.UnmarshalStrict

Changes from siderolabs/siderolink

2 commits

• 5f46f65 feat: handle panics in goroutines
• d09ff45 fix: race in wait value

Dependency Changes

• github.com/go-logr/logr v1.4.2 new
• github.com/go-playground/validator/v10 v10.26.0 new
• github.com/siderolabs/gen v0.8.1 -> v0.8.4
• github.com/siderolabs/siderolink v0.3.14 -> v0.3.15
• golang.org/x/crypto v0.38.0 -> v0.39.0
• golang.org/x/net v0.40.0 -> v0.41.0
• golang.org/x/sync v0.14.0 -> v0.15.0
• golang.org/x/text v0.25.0 -> v0.26.0

Previous release can be found at v0.50.0

v0.51.0-beta.2

Omni 0.51.0-beta.2 (2025-06-18)

Welcome to the v0.51.0-beta.2 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Omni can now be configured using YAML configuration file in addition to the command line flags.
The parameter --config-file can be used for that. Any command line flags have higher priority.

Contributors

• Artem Chernyshev

Changes

3 commits

• a36d357 release(v0.51.0-beta.2): prepare release
• 493d00c fix: properly support --config-path argument
• 742faec fix: do not mark SAML and Auth0 config sections as mutually exclusive

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.51.0-beta.1

v0.51.0-beta.1

Omni 0.51.0-beta.1 (2025-06-15)

Welcome to the v0.51.0-beta.1 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Contributors

• Utku Ozdemir

Changes

3 commits

• de86c74 release(v0.51.0-beta.1): prepare release
• 4b40dc1 fix: do more fixes on config backward-compatibility
• 3085c3f fix: remove required config validation from k8s proxy cert and key

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.51.0-beta.0