chore: prepare Talos 1.14 RC rebuild

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
           curl -sfL "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz" \
             | tar -xz -C /usr/local/bin gitleaks
       - name: Detect secrets
-        run: gitleaks detect --source . --redact
+        run: gitleaks detect --config .gitleaks.toml --source . --redact
 
   validate:
     name: Manifest validation

.gitleaks.toml

@@ -8,5 +8,6 @@ useDefault = true
 description = "generated Talos inline manifests"
 paths = [
   '''omni\/patches\/.*-inline-manifests\.yaml''',
+  '''omni\/cluster-templates\/patches\/.*-inline-manifests\.yaml''',
   '''clusters\/.*\/omni\/inline-manifests\.yaml''',
 ]

clusters/unraid-lab/apps/etcd-metrics-network-policy/application.yaml

@@ -1,5 +1,5 @@
 # The Talos etcd metrics listener is unauthenticated. Only the Grafana metrics
-# collector may initiate connections to control-plane port 2381.
+# collector may initiate connections to control-plane port 2383.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:

clusters/unraid-lab/apps/etcd-metrics-network-policy/manifests/policy.yaml

@@ -19,5 +19,5 @@ spec:
         - remote-node
       toPorts:
         - ports:
-            - port: "2381"
+            - port: "2383"
           protocol: TCP

omni/cluster-templates/oci-lab.yaml

@@ -4,19 +4,20 @@ labels:
   environment: oci
 kubernetes:
   # Not touched by the talos-images upgrade workflow — bump deliberately, one
-  # minor at a time. v1.37.0-beta.0 is Talos 1.14.0-beta.1's own
+  # minor at a time. v1.37.0-rc.0 is Talos 1.14.0-rc.1's own
   # DefaultKubernetesVersion (same value unraid-lab's canary uses), not an
   # inherited/mismatched pin — matches the Talos version below on purpose.
   version: v1.36.3
 talos:
   # Keep in step with installImage in omni/machine-classes/*.yaml.
-  version: v1.14.0-beta.1
+  version: v1.14.0-rc.1
 # Patches live in the sibling patches/ directory, so paths no longer traverse
 # upward and no `--allowed-dir` flag is needed. `status` now works without it.
 patches:
   - file: patches/cni-none.yaml
   - file: patches/disable-kube-proxy.yaml
   - file: patches/allow-scheduling.yaml
+  - file: patches/talos-1.14-compat.yaml
   - file: patches/oci-lab-inline-manifests.yaml
 ---
 # omnictl requires ControlPlane and Workers as SEPARATE documents. They were

omni/cluster-templates/patches/talos-1.14-compat.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1alpha1
+kind: SecurityProfileConfig
+workloadIsolation: false
+---
+apiVersion: v1alpha1
+kind: CRICustomizationConfig
+name: disable-nri
+content: |
+  [plugins]
+    [plugins."io.containerd.nri.v1.nri"]
+      disable = true

omni/machine-classes/control-plane.yaml

@@ -4,7 +4,7 @@ metadata:
   type: MachineClasses.omni.sidero.dev
   id: oci-cp
 spec:
-  installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0-beta.1
+  installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0-rc.1
   # Omni's MachineClass spec takes `matchlabels` (lowercase) as a LIST of
   # label selector strings. It was written as a camelCase map, which Omni
   # rejects with "machine class should either have auto provision or match

omni/machine-classes/worker.yaml

@@ -4,7 +4,7 @@ metadata:
   type: MachineClasses.omni.sidero.dev
   id: oci-worker
 spec:
-  installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0-beta.1
+  installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0-rc.1
   # Omni's MachineClass spec takes `matchlabels` (lowercase) as a LIST of
   # label selector strings. It was written as a camelCase map, which Omni
   # rejects with "machine class should either have auto provision or match

omni/scripts/generate-manifests.sh

@@ -74,9 +74,12 @@ patches:
       kind: ConfigMap
       name: argocd-cm
     patch: |-
-      - op: add
-        path: /data/application.resourceTrackingMethod
-        value: label
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: argocd-cm
+      data:
+        application.resourceTrackingMethod: label
   # argocd-server serves TLS on its own port by default and 307-redirects
   # any plain-HTTP request to https — including requests our own tailscale
   # Ingress forwards as plain HTTP after terminating TLS at the tailnet

omni/versions.yaml

@@ -12,7 +12,7 @@
 # overrides `talos` without `kubernetes` derives its Kubernetes version from
 # the supported versions of its own Talos target, not from the global pin.
 
-talos: v1.14.0-beta.1
+talos: v1.14.0-rc.1
 kubernetes: v1.36.3
 
 clusters:
@@ -21,7 +21,7 @@ clusters:
   # explicit override, not removed, so this stays true even if the global
   # pin moves again independently.
   unraid-lab:
-    talos: v1.14.0-beta.1
+    talos: v1.14.0-rc.1
     kubernetes: v1.36.3
 
   # Never successfully bootstrapped — no live state to protect, no backup

values/base/grafana-k8s-monitoring.yaml

@@ -78,9 +78,9 @@ collectors:
 
       prometheus.scrape "talos_etcd" {
         targets = [
-          { "__address__" = "192.168.122.109:2381", "instance" = "unraid-lab-control-planes-gwvq7k", "job" = "integrations/etcd" },
-          { "__address__" = "192.168.122.190:2381", "instance" = "unraid-lab-control-planes-hqf6vh", "job" = "integrations/etcd" },
-          { "__address__" = "192.168.122.214:2381", "instance" = "unraid-lab-control-planes-htvzs7", "job" = "integrations/etcd" },
+          { "__address__" = "192.168.122.109:2383", "instance" = "unraid-lab-control-planes-gwvq7k", "job" = "integrations/etcd" },
+          { "__address__" = "192.168.122.190:2383", "instance" = "unraid-lab-control-planes-hqf6vh", "job" = "integrations/etcd" },
+          { "__address__" = "192.168.122.214:2383", "instance" = "unraid-lab-control-planes-htvzs7", "job" = "integrations/etcd" },
         ]
         scrape_interval = "60s"
         scrape_timeout = "10s"