v0.1.7

Released 2026-08-16. Full notes: v0.1.7-RELEASE-NOTES.md · GitHub release.

Highlights

• Talos upgrades work. patchTalosConfig had been deleting machine.install, so every upgrade failed in metal mode; basePatch now sets install.disk: /dev/sda. just talos-upgrade <ip> [base|gpu] [drain] drops --preserve and can skip the drain. Talos 1.13.8.
• Longhorn attach deadlock. The control-plane toleration on longhornManager registered control planes as Longhorn nodes where engine images never deploy, so no volume could attach. Removed.
• Wildcard TLS outage. A duplicate Certificate in cilium-secrets exhausted Let’s Encrypt’s 5-per-168h limit. One Certificate in kube-system; Cilium’s secretsNamespace.sync mirrors it.
• Falco UI. Redis retention capped (webui.ttl: 7d) after MISCONF wedged it; login moved to OpenBao secret/falco.
• ComfyUI on the cu130-megapak line and just comfyui on|off; new recipes just longhorn-repair-iscsi and just gateway-repair-l2.
• Docs moved to one home per version, enforced by just docs-check.

Manual steps

1. On existing clusters, expand the Falco UI Redis PVC once (the TTL only governs new keys):

   kubectl patch pvc -n falco falco-falcosidekick-ui-redis-data-falco-falcosidekick-ui-redis-0 \
     -p '{"spec":{"resources":{"requests":{"storage":"4Gi"}}}}'

2. Create the falco OpenBao policy, role and login before the Falco sync — now done by just openbao-setup.
3. After each Talos upgrade, run just longhorn-repair-iscsi if volumes fault (the recipe now runs it for you).

Gotchas found in the rollout — stale L2 leases, nodes that cannot reboot gracefully, Kubernetes not riding along with Talos — are folded into Upgrades.