From 6d58f603b96ae5ce82835ed0ccf1ec0db68bcfbd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 4 Sep 2026 11:44:02 +0000 Subject: [PATCH 1/3] chore: Talos upgrade to v1.14.0 (k8s v1.37.0) --- omni/talos-image.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/omni/talos-image.yaml b/omni/talos-image.yaml index 674ddcd..9825138 100644 --- a/omni/talos-image.yaml +++ b/omni/talos-image.yaml @@ -1,8 +1,8 @@ # Auto-updated by talos-images workflow — do not edit manually -talos_version: v1.13.9 +talos_version: v1.14.0 kubernetes_version: v1.36.3 -default_kubernetes_version: v1.36.3 +default_kubernetes_version: v1.37.0 schematic_id: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba -oci_image_ocid: ocid1.image.oc1.uk-london-1.aaaaaaaaicso725imd422ltao5z6nzylfuzxfiknwygdt6wifmhplgq6pjhq +oci_image_ocid: ocid1.image.oc1.uk-london-1.aaaaaaaaqath6vreyhaqnqt7yrxsibfgcuhwqtz7ldia3pd3y2my7eplomya firecracker_extension_version: talos-ext-firecracker-v1.13.0 -updated_at: 2026-08-24T00:26:37Z +updated_at: 2026-09-04T11:44:02Z From a197620414c1459424eb4d7b93b4731a991809bf Mon Sep 17 00:00:00 2001 From: Giovanni Ferri Date: Fri, 4 Sep 2026 12:46:19 +0100 Subject: [PATCH 2/3] chore: pin Talos v1.14.0 in versions.yaml --- omni/cluster-templates/oci-lab.yaml | 2 +- omni/machine-classes/control-plane.yaml | 2 +- omni/machine-classes/worker.yaml | 2 +- omni/versions.yaml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/omni/cluster-templates/oci-lab.yaml b/omni/cluster-templates/oci-lab.yaml index 50591c1..e669643 100644 --- a/omni/cluster-templates/oci-lab.yaml +++ b/omni/cluster-templates/oci-lab.yaml @@ -10,7 +10,7 @@ kubernetes: version: v1.36.3 talos: # Keep in step with installImage in omni/machine-classes/*.yaml. - version: v1.13.9 + version: v1.14.0 # Patches live in the sibling patches/ directory, so paths no longer traverse # upward and no `--allowed-dir` flag is needed. `status` now works without it. patches: diff --git a/omni/machine-classes/control-plane.yaml b/omni/machine-classes/control-plane.yaml index 2da65c0..c03111e 100644 --- a/omni/machine-classes/control-plane.yaml +++ b/omni/machine-classes/control-plane.yaml @@ -4,7 +4,7 @@ metadata: type: MachineClasses.omni.sidero.dev id: oci-cp spec: - installImage: ghcr.io/syscode-labs/talos-images/installer:v1.13.9 + installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0 # Omni's MachineClass spec takes `matchlabels` (lowercase) as a LIST of # label selector strings. It was written as a camelCase map, which Omni # rejects with "machine class should either have auto provision or match diff --git a/omni/machine-classes/worker.yaml b/omni/machine-classes/worker.yaml index 44760f8..0c04edc 100644 --- a/omni/machine-classes/worker.yaml +++ b/omni/machine-classes/worker.yaml @@ -4,7 +4,7 @@ metadata: type: MachineClasses.omni.sidero.dev id: oci-worker spec: - installImage: ghcr.io/syscode-labs/talos-images/installer:v1.13.9 + installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0 # Omni's MachineClass spec takes `matchlabels` (lowercase) as a LIST of # label selector strings. It was written as a camelCase map, which Omni # rejects with "machine class should either have auto provision or match diff --git a/omni/versions.yaml b/omni/versions.yaml index dab411e..08eba5b 100644 --- a/omni/versions.yaml +++ b/omni/versions.yaml @@ -12,14 +12,14 @@ # overrides `talos` without `kubernetes` derives its Kubernetes version from # the supported versions of its own Talos target, not from the global pin. -talos: v1.13.9 +talos: v1.14.0 kubernetes: v1.36.3 clusters: # Kept as an explicit override so this stays true even if the global pin # moves again independently. unraid-lab: - talos: v1.13.9 + talos: v1.14.0 kubernetes: v1.36.3 # Never successfully bootstrapped — no live state to protect, no backup From 17c72d821510a9783a5d611f5d32a4e79ae0e36f Mon Sep 17 00:00:00 2001 From: Giovanni Ferri Date: Fri, 4 Sep 2026 13:05:07 +0100 Subject: [PATCH 3/3] fix: unblock release CI validation --- ...-08-30-always-prefix-appset-apps-design.md | 38 ++++++++++--------- values/base/tailscale-operator.yaml | 4 +- 2 files changed, 22 insertions(+), 20 deletions(-) diff --git a/docs/plans/2026-08-30-always-prefix-appset-apps-design.md b/docs/plans/2026-08-30-always-prefix-appset-apps-design.md index 6b29a4a..06ae4b8 100644 --- a/docs/plans/2026-08-30-always-prefix-appset-apps-design.md +++ b/docs/plans/2026-08-30-always-prefix-appset-apps-design.md @@ -8,13 +8,14 @@ **Tech Stack:** Argo CD ApplicationSet (Go templating), `appset.yaml`, `AGENTS.md`, `bootstrap/argocd-cm.yaml` (already has display label), `kubectl`/`omnictl` verification. -### Task 1: Write failing test for always-prefix rule +## Task 1: Write failing test for always-prefix rule **Files:** + - Create: `/tmp/tdd_appset_prefix_test.py` - Test: checks `appset.yaml` template name contains `{{.clusterName}}-{{.path.basename}}` and does NOT contain the old conditional `if eq .clusterName "oci-lab"` -**Step 1: Write the failing test** +### Step 1: Write the failing test ```python import pathlib @@ -28,21 +29,23 @@ if __name__ == "__main__": test_always_prefix(); print("PASS") ``` -**Step 2: Run test to verify it fails** +### Step 2: Run test to verify it fails Run: `python3 /tmp/tdd_appset_prefix_test.py` Expected: FAIL (old conditional present) -**Step 3: Commit test (not yet, keep as /tmp for TDD gate)** +### Step 3: Commit test (not yet, keep as /tmp for TDD gate) -### Task 2: Update ApplicationSet template to always prefix +## Task 2: Update ApplicationSet template to always prefix **Files:** + - Modify: `/Users/giovanni/syscode/git/syscode-homelab-gitops-apps/appset.yaml:78-83` -**Step 1: Edit template** +### Step 1: Edit template Old: + ```yaml template: metadata: @@ -52,6 +55,7 @@ Old: ``` New: + ```yaml template: metadata: @@ -61,19 +65,20 @@ New: name: '{{ .clusterName }}-{{ .path.basename }}' ``` -**Step 2: Run test to verify it passes** +### Step 2: Run test to verify it passes Run: `python3 /tmp/tdd_appset_prefix_test.py` Expected: PASS -**Step 3: Run existing related tests** +### Step 3: Run existing related tests Run: `python3 /tmp/label_test.py && python3 /tmp/tdd_custom_labels_test.py && python3 /tmp/tdd_argocd_rbac_test.py` Expected: All PASS (label test must be updated — see Task 3) -### Task 3: Update label-test expectations and repo rule +## Task 3: Update label-test expectations and repo rule **Files:** + - Modify: `/tmp/label_test.py` (if it asserts names) — actually label_test checks labels, not names, so no change needed - Modify: `/Users/giovanni/syscode/git/syscode-homelab-gitops-apps/AGENTS.md` — add rule under GitNexus or new section: @@ -85,29 +90,29 @@ Expected: All PASS (label test must be updated — see Task 3) Or create `.claude/skills/app-naming/SKILL.md` with same rule if a skills dir is preferred. -**Step 1: Edit AGENTS.md** +### Step 1: Edit AGENTS.md Add after GitNexus section. -**Step 2: Verify no stale references** +### Step 2: Verify no stale references Run: `grep -R "oci-lab-{{" appset.yaml` should be gone; `grep -R "unraid-lab-cilium" docs/` should appear only in plan. -### Task 4: Verify migration impact and sync +## Task 4: Verify migration impact and sync **Files:** none — operational verification -**Step 1: Render and diff** +### Step 1: Render and diff Run: `git diff appset.yaml` Expected: single hunk, name line change + comment -**Step 2: Predict Argo behavior** +### Step 2: Predict Argo behavior - Old unprefixed apps (`cilium`, `cert-manager`, `radar`, etc. on `unraid-lab`) will be pruned (automated prune:true) and recreated as `unraid-lab-cilium`, etc. Helm `releaseName` unchanged, so chart resources are not deleted — only the Application CR is renamed. Verify by checking `spec.sources[0].helm.releaseName` is still `{{.path.basename}}` (unchanged). -**Step 3: Push and force-sync ApplicationSet** +### Step 3: Push and force-sync ApplicationSet ```bash git add appset.yaml AGENTS.md @@ -119,7 +124,7 @@ kubectl -n argocd patch applicationset apps --type merge -p '{"metadata":{"annot Observe `kubectl -n argocd get applications --no-headers | grep -E "cilium|cert-manager|radar"` should show `unraid-lab-*` and `oci-lab-*` pairs, old names gone. -### Task 5: Final verification-before-completion +## Task 5: Final verification-before-completion **Run:** @@ -132,4 +137,3 @@ kubectl -n argocd get applications -o custom-columns=NAME:.metadata.name,CLUSTER ``` Expected: Both `unraid-lab-cilium` and `oci-lab-cilium` present, old `cilium` absent after prune. - diff --git a/values/base/tailscale-operator.yaml b/values/base/tailscale-operator.yaml index aeb26a3..d1d98ab 100644 --- a/values/base/tailscale-operator.yaml +++ b/values/base/tailscale-operator.yaml @@ -1,5 +1,3 @@ # Tags common to every cluster's Tailscale operator-managed nodes. proxyConfig: - defaultTags: - - tag:k8s-operator - - tag:talos + defaultTags: "tag:k8s-operator,tag:talos"