omnictl: baixar versions anteriors

Omni 1.12.4 (2026-10-07)
Welcome to the v1.12.4 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Local Resource Service Removal
The local resource service, which served Omni resources on a local listener, is removed. Consumers should reach Omni through its regular API with a service account instead. Its services.localResourceService settings and flags have no effect.
Contributors
- Utku Ozdemir
- Oguz Kilcan
- Artem Chernyshev
- Andy Longwill
- immanuwell
Changes
22 commits
- f9d1743a5 release(v1.12.4): prepare release
- a1265ba7a fix: return only the unauthenticated error for an unsigned request
- 69c79f273 fix: redact config secrets and clear the stored OIDC client secret
- 3b0446c85 fix: forward only known headers to the Kubernetes apiserver
- 4dfee714f fix: remove conflicting join token renew alias
- 6eddd8c08 fix: require a confirmed key for workload proxy access
- 18ac5ee9d fix: make a resource's cluster label agree with its target
- 3b2a95383 fix: extract the cluster ID from label query terms correctly
- 42a6dd708 feat: allow upgrading one deprecated Talos to another one in maintenance
- 999446893 fix: do not allocate machines with outdated schematics into a cluster
- 3526d6614 fix: reject unknown Talos versions on the talosctl downloads endpoint
- 7d5c9bf5c feat: remove the local resource service
- 33d8d5b7e fix: resolve node headers only for the runtime that uses them
- d9e69d606 fix: read local resource server stream metadata from its own context
- dcfa43a27 fix: verify the caller before reporting a resolution failure
- 29958ee1a fix: check access before rejecting a request that names several nodes
- e38d71c06 fix: record the outcome of Talos access in the audit log
- 6f7d8c83e fix: parse the role of a public key request before any lookup
- 2982aa994 fix: return only the access error for a denied request
- fcf4c8568 fix: return the same error for a missing and an inaccessible target
- 668469919 chore: bump otel libraries to close a vuln
- 47322b255 fix(frontend): add v prefix to installer image tag
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.12.3

Omni 1.12.3 (2026-09-30)
Welcome to the v1.12.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
Changes
5 commits
- 74b0bd683 release(v1.12.3): prepare release
- 78d0cc7a1 fix(frontend): make some style fixes on cluster list
- 9d7af1d54 feat(frontend): add a resource browser to the UI
- a9a16e0c9 fix(frontend): check kubespanlink instead of kubespanconfig
- aa217700e feat(frontend): add enterprise labels to maintenance modals
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.12.2

Omni 1.12.2 (2026-09-23)
Welcome to the v1.12.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
- immanuwell
- Edward Sammut Alessi
Changes
7 commits
- 020bfffc1 release(v1.12.2): prepare release
- 26fdb97e5 fix: keep the cached Talos clients alive while they are in use
- c7f88c92a fix: reject unknown omnictl config contexts
- 318674380 fix: do not report k8s manifests as deleting when Omni does not own them
- 607d07bb4 fix(frontend): show enterprise label for cluster on overview
- 259aa95ce fix: forbid changing roles to or from InfraProvider
- 5678d3a89 fix: honor context override in omnictl config info
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.12.1

Omni 1.12.1 (2026-09-15)
Welcome to the v1.12.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
- Andrey Smirnov
- Artem Chernyshev
- Utku Ozdemir
- immanuwell
Changes
16 commits
- 97e51eafd release(v1.12.1): prepare release
- 60deeecce test: drop MinIO usage in the tests
- 663e550b7 feat(frontend): show a message that cluster security UI requires enterprise
- a0e2c0e84 feat(frontend): add enterprise label to cluster overview
- d3c2eb3db feat: copy enterprise label to more resources
- 62ac3b806 feat(frontend): handle not found scan reports in ui
- 5a2a27e06 fix: allow image removal API
- 6fb7e330d fix(frontend): make security docs link _blank
- ddddf4729 feat(frontend): group talos versions by minor
- 0b9eef767 feat(frontend): add enterprise label to talos select lists
- dfa4b52ee refactor(frontend): extract all select components into individual files
- 87c525a61 refactor(frontend): create a singular talos version select component
- 0270ead84 fix: remove incomplete installation media downloads
- ed531d7fd refactor: normalize factory urls at input only
- b35962912 feat(frontend): add loading state for image download links
- 17086d6f9 fix: keep the untouched machines out of a canceled Talos upgrade
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.12.0

Omni 1.12.0 (2026-09-11)
Welcome to the v1.12.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Image Factory API Token Authentication
Omni can now authenticate to the image factory with an API token. The token is read from a file, so it can be rotated without a restart. Basic auth is still supported for self-hosted factories using htpasswd.
For such a factory, Omni creates a machine token and puts it into the registry auth config of every machine, so that the machines can pull images from the factory.
The token file is configured under registries.factories.<primary|secondary> in the config file:
registries:
factories:
primary:
url: https://factory.example.com
tokenFile: /run/secrets/factory-token
The equivalent flags are --primary-factory-token-file and --secondary-factory-token-file.
Security Scans in omnictl
The new omnictl security command fetches the security artifacts of a Talos schematic from the enterprise image factory:
- scan: the vulnerability scan report.
- sbom: the SPDX SBOM.
- vex: the VEX document.
It takes either a cluster ID, covering every schematic and architecture the cluster runs, or an explicit combination of Talos version, architecture and schematic. The scan output also shows the available Talos upgrade paths and the vulnerability diff for each of them.
These artifacts are only available on the enterprise image factory, so the command requires Omni to be configured with one.
Contributors
- Utku Ozdemir
- Edward Sammut Alessi
- Mateusz Urbanek
- Andrey Smirnov
- Dmitrii Sharshakov
- Immanuel Tikhonov
- Mateusz Urbanek
- Noel Georgi
Changes
27 commits
- cd616f1cd release(v1.12.0): prepare release
- 6192a1450 feat: add security scans to omnictl
- 6cdda713c fix: revert stabilizing the tunnel peer address across provisions
- c4a37d55e test: run the enterprise image factory tests against the staging factory
- c832a504f feat: make the lifetime of the image factory machine tokens configurable
- 70814f39c refactor(frontend): make frontend obtain artifact targets from backend
- d525fda6c feat: implement ClusterArtifactTargets rpc call
- ccc80d254 feat: add ClusterArtifactTargets rpc method
- af65853e0 release(v1.12.0-beta.0): prepare release
- 723666686 fix: restore the extra parameters of the sqlite connection string
- 08695407d fix: read the node unique token uncached in the cleanup controller
- 9ddfa5246 feat: authenticate to the image factory with an API token
- 800bcac19 test: use ECDSA service account keys for the clusters in the tests
- cd8598724 fix: generate the registry auth document by the running Talos version
- acc0c4f40 chore: bump delve version in compose
- 6692b2c0b fix: ensure the schematic on the target factory before an install
- 8c7699a77 fix: run the sqlite database with the NORMAL synchronous mode
- d8a281c42 chore(frontend): bump deps
- 49861a25e fix: reuse the node unique token already written to the machine
- 74003273c chore: bump deps, rekres, Talos 1.13.10
- 0a6d296fd test: poll for Vault readiness instead of sleeping in the tests
- d411b2554 test: increase the timeout of the node label check
- 46e112ac4 chore(frontend): remove factory urls from csp
- 8cbf034be fix: keep the machine extensions consistent across extensions configurations
- 0a22ac7af fix(frontend): distinguish initial log fetch failures
- 4c833c7e1 fix: apply the registry mirrors to machines in maintenance mode
- edcad2769 fix: retry the installer image pull in the maintenance lifecycle API
Changes since v1.12.0-beta.0
8 commits
- cd616f1cd release(v1.12.0): prepare release
- 6192a1450 feat: add security scans to omnictl
- 6cdda713c fix: revert stabilizing the tunnel peer address across provisions
- c4a37d55e test: run the enterprise image factory tests against the staging factory
- c832a504f feat: make the lifetime of the image factory machine tokens configurable
- 70814f39c refactor(frontend): make frontend obtain artifact targets from backend
- d

Omni 1.11.0 (2026-09-04)
Welcome to the v1.11.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Frontend Quality-of-Life Improvements
Align the UI features on the Cluster scale and Cluster create pages. Support searching by labels on Cluster scaling/create pages.
Install Disk Configs
Config Patches can no longer be used for setting Talos install disk. Starting from Talos 1.14 installation flow was changed a lot so setting the install disk in the configs will no longer work. Install disk is now defined in a separate resource and works differently for the older Talos versions.
Kubernetes Token Signing Keys
Admins can now list the keys that sign Kubernetes access tokens and delete them. Deleting one immediately invalidates every kubeconfig and OIDC token it signed, which is what it takes to pull a long-lived service account kubeconfig out of circulation before it expires.
See documentation for more details.
Recovery Admin for SAML Lockouts
auth.recoveryAdmin config, or the --recovery-admin flag can be used to elevate a user to Admin on every Omni start.
It also blocks user demotion through SAML label rules. This is the way back in when a SAML rule strips Admin from everyone. Only existing users can be promoted.
Contributors
- Edward Sammut Alessi
- Utku Ozdemir
- Oguz Kilcan
- Spencer Smith
- Mateusz Urbanek
- Artem Chernyshev
- Andrey Smirnov
- Kevin Tijssen
- Orzelius
- Noel Georgi
- Tim Jones
Changes
117 commits
- 973d1dfe7 release(v1.11.0): prepare release
- 50ccd9502 release(v1.11.0-beta.1): prepare release
- 4c61b2687 test: retry the maintenance upgrade right after the install reboot
- 87b704fb0 fix: make the omni log format of omnictl machine-logs work
- af6f9c6e4 fix: filter the output in omnictl
- dbf8024c1 fix: handle the META keys Talos 1.14 does not allow to write via the API
- a6fa429f4 fix: validate the kubeconfig received from the Omni API
- 23d722ad0 fix: remove documents dropped from config patches in maintenance mode
- 51560db91 fix: recognize the full AMD vendor name in the CPU label
- dbd30fd45 feat: report the number of machines by CPU core count
- 2b9494644 feat: use the Linux view of the CPU cores for machine hardware status
- 685ea82f4 fix: update COSI to 1.16.3
- 778192cd5 fix: don't give a UUID-conflicting machine the live machine's address
- 81e0f1364 fix: make the image factory credentials readable only by omni
- 92d72412e release(v1.11.0-beta.0): prepare release
- e402ff4ef chore: remove oauth2 client credentials auth for the image factory
- e460ae71e fix: retry a rejected bootstrap request at the next check
- b1341200b feat: authenticate PXE installation media with a download token
- b7b58efe8 feat: download installation media through the boot asset API
- e2ad5e43f refactor: rename the boot asset API to installation media URL
- f573426e4 test: fix a race between manual machine picks and machine classes
- 605a83da9 fix: apply pending updates to unhealthy machines so they can recover
- 9b6d554a3 feat(frontend): use download tokens for installation media
- 2491f1437 fix(frontend): fix filter check in pending machines
- fbaa7fb18 feat: regularly reconcile factory access tokens in cosi
- 23cc61d91 feat: add image factory token resource
- 1eecc480a feat: add image factory oauth2 client config
- a96ef43d2 chore: bump deps and default versions
- 36bd2eccc fix: mark a cluster as bootstrapped only once etcd is running on the node
- 71ee3ad80 test: fix a race in the preserve-features machine config test
- 3794b1177 feat: authenticate boot asset downloads with image factory tokens
- 4bbd713da refactor: move the cluster and metrics controllers into their packages
- ace063b53 fix: record the image factory host for machines already at target
- 8c003994b test: adapt the integration tests to Talos 1.14
- 78d56b38d chore: prepare Omni for Talos 1.14
- e37ab210b test: trim redundant legacy manifest group id cases
- f8b9cfc30 fix: migrate legacy we

Omni 1.10.6 (2026-09-04)
Welcome to the v1.10.6 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
- Oguz Kilcan
- Andrey Smirnov
- Artem Chernyshev
- Tim Jones
Changes
9 commits
- bb8eee1f release(v1.10.6): prepare release
- 7c549374 chore: bump siderolink to v0.3.17
- 92e8440f fix: make the omni log format of omnictl machine-logs work
- 8385d3a2 fix: handle the META keys Talos 1.14 does not allow to write via the API
- e8c13956 fix: update COSI to 1.16.3
- a8a2e61a fix: don't give a UUID-conflicting machine the live machine's address
- 9c91887f fix: record the image factory host for machines already at target
- cc33057a chore: bump go
- 80f1bccd fix: siderolink api label
Changes from siderolabs/siderolink
4 commits
- ad296ab chore: rekres, bump deps
- 23030b0 fix: keep a replacement gRPC stream's send queue after cleanup
- 4b69f46 fix: correct the wireguard device error handling
- 5157d0c fix: accept valid short IPv6 packets on filtered devices
Dependency Changes
- github.com/cosi-project/runtime v1.16.2 -> v1.16.3
- github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 -> v2.30.0
- github.com/siderolabs/siderolink v0.3.16 -> v0.3.17
- github.com/stretchr/testify v1.11.1 -> v1.12.1
- golang.org/x/crypto v0.54.0 -> v0.55.0
- golang.org/x/net v0.57.0 -> v0.58.0
- golang.org/x/text v0.40.0 -> v0.41.0
- google.golang.org/grpc v1.83.0 -> v1.83.2
- google.golang.org/protobuf f2248ac996af -> v1.36.12
Previous release can be found at v1.10.5

Omni 1.10.5 (2026-08-24)
Welcome to the v1.10.5 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
- Andrey Smirnov
- Artem Chernyshev
- Oguz Kilcan
Changes
8 commits
- 3da514071 release(v1.10.5): prepare release
- 0f61f97fc test: fix talemu version to v1.0.0-6-g9326528
- f3e43cf2d fix: provide machine id consistently in provision API logs
- 51470e023 fix: add missing timeout to the version API call in the identity task
- f74555395 fix: change incorrect version contract for kubespan
- 6c0985051 fix: stop a link to an exposed service from starting a login flow
- 1029e9c37 feat(frontend): add filename param to image downloads
- b49f605bc fix(frontend): fix etcd backup interval not editable
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.10.4

Omni 1.10.4 (2026-08-18)
Welcome to the v1.10.4 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Revoking Kubernetes Access Tokens
Admins can now list the keys which sign the Kubernetes access tokens and delete them using omnictl. Deleting a key immediately invalidates all the tokens signed by it, such as the long-lived service account kubeconfigs, without a restart. Deleting the most recent key is safe: a replacement is generated automatically when the next token is issued. The key deletions are recorded in the audit log.
Contributors
- Utku Ozdemir
Changes
2 commits
- 615998ab9 release(v1.10.4): prepare release
- bc586e4f7 feat: allow listing and deleting the Kubernetes token signing keys
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.10.3

Omni 1.10.3 (2026-08-14)
Welcome to the v1.10.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
Changes
2 commits
- 39bcff396 release(v1.10.3): prepare release
- 8bce1ddbd fix(frontend): check for navigation in preload error events
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.10.2

Omni 1.10.2 (2026-08-14)
Welcome to the v1.10.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
- Oguz Kilcan
Changes
3 commits
- 0a932d3df release(v1.10.2): prepare release
- 93fb429b4 chore: rekres and bump go
- 024fe1e4c fix(frontend): fix incorrect machine route params
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.10.1

Omni 1.10.1 (2026-08-12)
Welcome to the v1.10.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
- Oguz Kilcan
- Artem Chernyshev
- Utku Ozdemir
Changes
15 commits
- 0fbf63143 release(v1.10.1): prepare release
- a694edefb fix(frontend): fix reset wizard
- 7aa7a7e45 fix: compress diffs in the machine pending updates and diff history
- dd1b1dd97 fix: force re-authentication at the IdP so logout takes effect
- b5303320a fix: keep a machine's tunnel peer address stable across provisions
- 1005ec0d6 fix(frontend): return no-cache for index.html
- c9ba2048b fix: don't sign users out of Omni on Kubernetes OIDC logout
- 3b82989e1 fix(frontend): add missing credentials to security pages
- a2058e200 chore(frontend): bump dependencies
- 8a8fd2a1b test(frontend): add edit patch e2e test
- 4d1ed5bb5 fix(frontend): fix patch edit dropping fields
- 80b2e8586 fix: backfill the image factory host of machines enrolled before 1.10
- f28cdc77a fix: bound the machine config diff by bytes, not just lines
- 0e1259283 fix(frontend): be more defensive about signup errors
- 6b91ddb67 fix: log out of Omni and the IdP when /logout is opened directly
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.10.0

Omni 1.10.0 (2026-08-07)
Welcome to the v1.10.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Following the Audit Log
The audit log read API gains a follow mode. After serving the backlog the stream stays open and delivers new events as they are written, in insertion order. Followed events carry their ids, and a stream can start from an id received earlier, so a consumer resumes exactly where it left off. The start position can also be given as a timestamp. A follow stream ends cleanly after a bounded time rather than staying open indefinitely, and the client continues from the last id it received. omnictl performs that reconnect automatically. omnictl audit-log gains a --follow flag to tail the log live and a --since flag to start from a relative time in either mode. Reading the audit log now produces an audit log event of its own, recording who read it, the time range requested and the filters used, and the new event type can itself be filtered on.
Auditor Role
Reading the audit log required the Admin role, so anything that consumes audit events also had to hold user management and full administrative access to every managed Kubernetes cluster. The new Auditor role grants read access plus the audit log and nothing else. It is matched by exact role rather than by rank, so an Operator, which outranks an Auditor, still cannot read the audit log. It can be assigned to users and service accounts, but not through access policies or SAML label rules, which now reject roles that are not meant to be assigned that way.
Cluster Security Page
A new cluster security page lists the vulnerabilities of the images a running cluster uses, together with the upgrade paths that clear them, and the scan details can be filtered by severity. Vulnerability scanning requires the Image Factory Enterprise. Against the public factory the page reports that scanning is unavailable instead of showing results.
Kubernetes CA and Service Account Key Rejected in Config Patches
Config patches can no longer set the Kubernetes certificate authority or the service account signing key, which Omni generates and owns. This holds for every cluster, not only for clusters on the new Talos 1.14 document layout, and it covers the v1alpha1 fields as well as the Talos 1.14 documents that carry the same material. An already stored patch keeps working while it stays unchanged. Changing one that sets either of them is rejected, so such a patch has to be corrected before it can be edited again.
Disabling Config Patches
A config patch can now be disabled. It is retained as a resource but is never applied.
Discovery Service Configuration Reworked
Talos 1.14 replaces the single discovery endpoint with a configuration that can register a machine with more than one discovery service at once, and Omni now removes a departing machine's affiliate from every endpoint it used. A cluster used to pick either the public discovery service or the embedded one. For clusters created with Talos 1.14 or newer it can now also use both at the same time.
Talos Enterprise and FIPS Machine Labels
Machines running Talos Enterprise now get an omni.sidero.dev/enterprise label, and machines running Talos in FIPS mode get an omni.sidero.dev/fips label carrying either enabled or strict. Like the other labels Omni manages, they cannot be removed by the user, and they are cleared when a machine reverts to a regular build. Both values are read over the Talos API and watched for changes, since they follow the installed image. Older Talos versions do not report them, so machines running those get no labels.
Frontend Quality-of-Life Improvements
Machine names are shown the same way everywhere, using the hostname with the machine UUID as a fallback, and the machine stage is dimmed while a machine is unhealthy, with the last known status still shown. The home page replaces the radial bars with segmented ones and splits the machine stats into

Omni 1.9.3 (2026-07-16)
Welcome to the v1.9.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
Changes
2 commits
- 4e7e7bdd7 release(v1.9.3): prepare release
- 2039e64c2 fix: expose the machines cores and virtual state watches metrics
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.9.2

Omni 1.9.2 (2026-07-16)
Welcome to the v1.9.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
- Artem Chernyshev
- Edward Sammut Alessi
- Oguz Kilcan
Changes
9 commits
- d838af9f0 release(v1.9.2): prepare release
- cb70055a5 chore: fix linter errors
- 5e12de4eb fix: update kube-service-exposer to v0.4.0
- 6a09a6b60 feat: introduce the new metric that counts total number of cores
- 147eea3d1 fix: dont clear sa expiration when no keys are left
- 4833f75b5 fix: honor current machine set update limits
- bd0aee318 fix: properly propagate errors coming from the machine lifecycle API
- 8262b3d1b fix: don't treat unset S3 endpoint as an empty override
- 9c15aae24 fix(frontend): remove power icon from machines page
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.9.1

Omni 1.9.1 (2026-07-02)
Welcome to the v1.9.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
- Oguz Kilcan
- Utku Ozdemir
- Artem Chernyshev
- Nguyen Duc Quynh
Changes
16 commits
- 9df103729 release(v1.9.1): prepare release
- 6d8a8256f fix(frontend): prevent copying double newlines in machine logs
- d9b182274 refactor(frontend): replace ua-parser-js with bowser
- adec58a7a chore(frontend): drop yaml dependency and move openpgp to dependencies
- 434c8facd chore: rekres for js sbom
- ea05006d8 fix: update COSI runtime to fix hanging TeardownAndDestroy calls
- c9afbb1a6 fix: align config outdated status in ui and cli
- d8aec1c81 fix(frontend): only show process args in command column
- f7731e0ef fix(frontend): allow in-minor patch upgrades in update kubernetes on Omni
- cea826355 fix: advertise reachable machine API address in cluster-import test
- 07cfb3009 test: stabilize image-factory schematic across CI runs
- 039946447 test: drop non-existent preset delete error expectation
- 41d962e0f fix: tolerate NotFound on installation media preset delete
- 9e4509c25 fix: recover a machine from a reverted reboot-requiring config patch
- 88b8e873d fix: move timeout for factory requests to controllers
- 69d1a0e0e fix(frontend): allow force-destroy when MachineSetNode is already gone
Dependency Changes
- github.com/cosi-project/runtime v1.16.1 -> v1.16.2
Previous release can be found at v1.9.0

Omni 1.9.0 (2026-06-26)
Welcome to the v1.9.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Cluster Health Check Jobs
Cluster templates now support health check jobs that gate Talos upgrades. Omni creates the jobs when a Talos upgrade is running and re-runs them on an interval until they succeed, re-creating a job whenever it fails. The checks run before each node upgrade in the upgrade status controller, and if any defined health check fails Omni drops the available upgrade quota to zero, blocking further upgrades until the checks pass. You can read more about this feature on the docs.
Embedded Machine Config for Installation Media
Installation media can now carry an embedded machine configuration, so a machine applies it on first boot before it ever reaches Omni. You can set it from the frontend or with omnictl when creating installation media, and Omni stores it on the schematic request alongside the rest of the media config. The option is exposed only where the underlying stack reports support for it, through a new supports_embedded_config quirk.
Per-Class etcd Write Rate Limiting
You can now throttle etcd writes by payload size, with separate budgets for end users, infra providers, and internal callers. It is off by default and turns on via storage.rateLimits.etcd.*. Four new Prometheus series report throttle wait time, admitted writes, rejected writes, and rejected bytes, labeled by class. The failure counters also carry a reason of timeout or oversize.
Talos Extension Names Validated Against the Catalog
Extension names on installation media configs, machine request sets, and extensions configurations are now validated against the Talos extensions catalog for the relevant Talos version. Unknown names, duplicates, and oversized lists are rejected, and when no Talos version is set the default version's catalog is used so the names still get checked. Names without a namespace are looked up under siderolabs/, so older clients that send the documented short form keep working. The omnictl installation media create command now resolves short or partial extension names to canonical form before sending, replacing the client-side catalog check it used to do.
KubeSpan Status View
A new graphical view shows KubeSpan peer status for a cluster machine.
Frontend Quality-of-Life Improvements
A round of UI improvements across Omni. The home screen has a reworked "Welcome to Omni" card. An unhealthy infrastructure provider shows its error on hover, the machine details panel shows the SMBIOS serial number, and kernel args editing moved into a modal. Config diffs have a sort-order toggle, version pickers sort newest first and scroll to the current selection, and Talos and Kubernetes update calls now report their errors. The disks view got several cleanups, pods sort by status, power-state icons have tooltips, Omni shows a loading indicator when it is slow to start, and the rewritten log viewer scrolls to the bottom reliably. Machine patches no longer offer the cluster-machine patch option and surface an error when a machine is not part of a cluster.
Static loadBalancerIP for the WireGuard Service in Helm
The Helm chart has a new service.wireguard.loadBalancerIP value for setting a static load balancer IP on the WireGuard Kubernetes Service. It is rendered only when the WireGuard service type is LoadBalancer.
Support for Image Factory Enterprise
Two new config options, registries.imageFactoryUsername and registries.imageFactoryPassword, let Omni authenticate to the Image Factory Enterprise with HTTP basic auth.
Kubernetes Manifests Status in the UI
The frontend now shows the status of a cluster's synced Kubernetes manifests.
Per-Machine Log Ingestion Rate Limit
Log ingestion now uses a per-machine token bucket, so one noisy machine can no longer overwhelm the log store. It is off by default to keep backwards compatibility.
Machine Config Patches in Maintenance Mode
Om

Omni 1.8.2 (2026-06-05)
Welcome to the v1.8.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
As Omni is now using --join-tokens-mode=legacyAllowed by default it won't start if there are any nodes running Talos below 1.6 connected to the instance.
If you want to keep using Omni with the outdated Talos you will need to set the flag to legacy. But of course we strongly recommend you to update Talos ASAP.
omnictl cluster template has breaking changes: it now restricts including files outside of the current directory.
If using files in the parent dirs, old behavior can be enabled by using --allowed-dir.
Contributors
- Orzelius
- Utku Ozdemir
- Edward Sammut Alessi
- Oguz Kilcan
Changes
5 commits
- 13792557 release(v1.8.2): prepare release
- 8609a36f test: mock clock in saml test
- ab83b633 fix: prevent deadlock between machine upgrade and config update
- bcaa305a chore: bump go-kubernetes library
- a46d0065 fix: lower minimum discovered Kubernetes version
Changes from siderolabs/go-kubernetes
1 commit
- 131a2bd fix: handle cluster-scoped resources with a ns correctly
Dependency Changes
- github.com/siderolabs/go-kubernetes v0.2.37 -> v0.2.38
Previous release can be found at v1.8.1

Omni 1.8.1 (2026-05-29)
Welcome to the v1.8.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
As Omni is now using --join-tokens-mode=legacyAllowed by default it won't start if there are any nodes running Talos below 1.6 connected to the instance.
If you want to keep using Omni with the outdated Talos you will need to set the flag to legacy. But of course we strongly recommend you to update Talos ASAP.
omnictl cluster template has breaking changes: it now restricts including files outside of the current directory.
If using files in the parent dirs, old behavior can be enabled by using --allowed-dir.
Contributors
- Edward Sammut Alessi
- Utku Ozdemir
- Maja Bojarska
- Noel Georgi
Changes
10 commits
- 76af8b22 release(v1.8.1): prepare release
- 2d6a357d fix(frontend): bump @tanstack/vue-virtual for log viewer
- 4a19fddc fix: do not downgrade nodes header to single node
- 4f26d7bf fix(frontend): remove lingering test code
- 8ca3b41d feat(frontend): add tooltips to power state
- 18cdf4ad feat: refactor logviewer to tanstack virtual
- 3cf06b5a fix: fetch versions from registry with auth
- 620ff48c chore: bump deps to patch GO-2026-5027
- b1e970c5 feat(frontend): add some feedback when omni is loading
- 1bf2890d fix: dont clean clients with active watches
Dependency Changes
- golang.org/x/net v0.54.0 -> v0.55.0
Previous release can be found at v1.8.0

Omni 1.8.0 (2026-05-21)
Welcome to the v1.8.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
As Omni is now using --join-tokens-mode=legacyAllowed by default it won't start if there are any nodes running Talos below 1.6 connected to the instance.
If you want to keep using Omni with the outdated Talos you will need to set the flag to legacy. But of course we strongly recommend you to update Talos ASAP.
omnictl cluster template has breaking changes: it now restricts including files outside of the current directory.
If using files in the parent dirs, old behavior can be enabled by using --allowed-dir.
Additional Audit Log Filters
Audit logs gain a generic search box and sortable columns in the UI, plus CLI filters for event_type, resource_type, resource_id, cluster_id, and actor.
Per-Actor etcd Write Metrics
New omni_etcd_operations_total and omni_etcd_resource_bytes_total Prometheus counters track etcd writes, split by operation (create/update/teardown/destroy), actor (internal/user/service account/infra provider), actor ID, and resource type. Byte sizes are captured from the actual on-disk payload via a new WithObserver hook in state-etcd.
Disks and Devices on Machine Pages
The frontend now shows disks and devices on the machines and individual machine pages.
Talos Version Text on Installation Media Wizard
The installation media wizard's Talos version text has been updated for clarity.
Switching Logs Inside the Logs Tab
The logs tab now allows switching between log sources directly inside the tab.
Quick Switching Between Cluster Machines
The frontend allows quickly switching between machines within a cluster from the machine detail view.
In-UI Notifications
Omni notifications are now shown in the UI as dismissible banners.
Frontend Quality-of-Life Improvements for Machines
The cluster machine page gains a copy-UUID button, the machines list page can toggle between hostnames and UUIDs (with the preference saved), and machine and cluster machine pages gain kernel args tabs for editing kernel arguments inline instead of through a modal.
Re-Saving the Omni Support Bundle
The frontend now allows re-saving a previously generated Omni support bundle without regenerating it.
Support Modal
A new support modal in the frontend exposes links to GitHub issues, support channels, documentation, community resources, and office hours.
Helm Chart Values Generated From Config Schema
A new helmvaluesgen tool, run on make generate, updates the config: section of the Helm chart's values.yaml from Omni's config schema, applying chart-specific overrides for defaults, omissions, and descriptions.
Legacy Installation Media Proxying Removed
Omni no longer proxies legacy installation media download requests to the Talos Image Factory. Such requests are now rejected with a message asking users to upgrade omnictl, which downloads installation media directly from the factory.
Image Factory Proxy for Infra Providers
Infra provider Image Factory requests can now be proxied through Omni via a new schematic creation API that accepts raw YAML. This is useful when Omni holds authentication for the Image Factory or when multiple Image Factory endpoints need to be supported.
Imported Cluster Secrets Cleanup
A new controller tears down ImportedClusterSecrets once their content has been copied into ClusterSecrets and marked Imported=true, so imported bootstrap material does not linger in the state after a successful import.
Infra Provider Factory Endpoint
Infra providers now use the Image Factory endpoint configured in Omni's features state (sourced from args/config) instead of a hardcoded default. The configured factory URL is exposed on the provider.
Installation Media Placeholders
InstallationMediaConfig now accepts empty strings for talosVersion and joinToken, which resolve to the current stable version and default toke

Omni 1.7.3 (2026-05-12)
Welcome to the v1.7.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
A EULA agreement has been added to Omni which must be accepted in order to continue using it.
This agreement can be accepted through UI or programmatically either by adding the below flags:
--eula-accept-name=Your Name
--eula-accept-email=your@email.com
Or if using --config-path with the below configuration:
eulaAccept:
name: Your Name
email: your@email.com
Contributors
- Edward Sammut Alessi
- Oguz Kilcan
- Utku Ozdemir
- Andrey Smirnov
- Artem Chernyshev
Changes
12 commits
- e70a16e4 release(v1.7.3): prepare release
- 284a5516 chore: bump deps
- c0ad1c46 chore: bump deps
- 9426c2ca fix: add more input validations to management API
- 272d3f4d fix: consume SAML sessions once
- a199343b fix: do not panic is ssa apply with multi-version CRDs
- bb01bd81 feat: destroy imported cluster secrets after bundle is consumed
- f8596b67 fix(frontend): keep machine details open when switching
- a224cb02 fix: change ImportedClusterSecrets access level to operator
- 2f780520 fix(frontend): add apexcharts formatter workaround
- 72907427 fix(frontend): fix apexcharts broken tooltips and initial state
- 88fd0562 fix(frontend): fix revoking/deleting join tokens
Changes from siderolabs/go-kubernetes
2 commits
- 38c182f fix: normalize the changeset to be keyed without apiVersion
- ca35008 feat: update k8s api to 0.36.0
Dependency Changes
- github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.12 -> v1.22.13
- github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0 -> v1.99.0
- github.com/coreos/go-oidc/v3 v3.17.0 -> v3.18.0
- github.com/cosi-project/runtime v1.14.1 -> v1.15.1
- github.com/fluxcd/cli-utils v0.37.2-flux.1 -> v1.2.0
- github.com/fluxcd/pkg/ssa v0.70.0 -> v0.73.0
- github.com/google/go-containerregistry v0.21.4 -> v0.21.5
- github.com/siderolabs/go-kubernetes v0.2.36 -> v0.2.37
- github.com/siderolabs/omni/client v1.6.1 -> v1.6.5
- github.com/zitadel/oidc/v3 v3.46.0 -> v3.47.2
- golang.org/x/crypto v0.49.0 -> v0.50.0
- golang.org/x/net v0.52.0 -> v0.53.0
- golang.org/x/text v0.35.0 -> v0.36.0
- golang.org/x/tools v0.43.0 -> v0.44.0
- k8s.io/api v0.35.3 -> v0.36.0
- k8s.io/apimachinery v0.35.3 -> v0.36.0
- k8s.io/client-go v0.35.3 -> v0.36.0
- sigs.k8s.io/controller-runtime v0.23.3 -> v0.24.0
Previous release can be found at v1.7.2

Omni 1.7.2 (2026-05-05)
Welcome to the v1.7.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
A EULA agreement has been added to Omni which must be accepted in order to continue using it.
This agreement can be accepted through UI or programmatically either by adding the below flags:
--eula-accept-name=Your Name
--eula-accept-email=your@email.com
Or if using --config-path with the below configuration:
eulaAccept:
name: Your Name
email: your@email.com
Contributors
- Edward Sammut Alessi
- Artem Chernyshev
- Utku Ozdemir
Changes
12 commits
- e739ed28 release(v1.7.2): prepare release
- 11fbbdb7 fix(frontend): only show machine patches for currently visible machine
- 43f5d4cb fix(frontend): fix editing labels on machine class
- 79d26cb0 fix: fix the storm of PendingUpdateStatus create/destroy
- 5be4db0f fix: bring back election campaign resign code in the etcd state
- aca77a20 fix: stop logging Kubernetes read checks
- b887e0d7 fix: remove workload proxy deployment when disabled on the account
- ab2f431e fix(frontend): fix eula handling to prevent being stuck on /eula
- ab4763d4 fix(frontend): fix indeterminate state for update extensions modal
- b979f98a feat(frontend): update talos version text on installation media wizard
- 2a0d0f4c fix(frontend): clear page state when keys are cleared
- c2adc51a fix(frontend): select default join token in installation media wizard
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.7.1

Omni 1.7.1 (2026-04-24)
Welcome to the v1.7.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
A EULA agreement has been added to Omni which must be accepted in order to continue using it.
This agreement can be accepted through UI or programmatically either by adding the below flags:
--eula-accept-name=Your Name
--eula-accept-email=your@email.com
Or if using --config-path with the below configuration:
eulaAccept:
name: Your Name
email: your@email.com
Contributors
- Artem Chernyshev
Changes
2 commits
- 1074e213 release(v1.7.1): prepare release
- 360dc72d fix: skip allocating nodes for deleted/tearing down MachineRequests
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.7.0

Omni 1.7.0 (2026-04-17)
Welcome to the v1.7.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
A EULA agreement has been added to Omni which must be accepted in order to continue using it.
This agreement can be accepted through UI or programmatically either by adding the below flags:
--eula-accept-name=Your Name
--eula-accept-email=your@email.com
Or if using --config-path with the below configuration:
eulaAccept:
name: Your Name
email: your@email.com
Allow Machine Request Destroy
Machine requests are now created without a controller owner, allowing operators and admins to teardown stuck or unwanted requests directly. The controller replaces destroyed requests automatically to maintain the desired machine count.
Browsable Audit Logs in the UI
Audit logs are now browsable directly in the Omni UI, making it easier to review audit events without CLI access.
Human-Readable Config Validation Errors
Configuration validation errors are now presented in a human-readable format, making it easier to diagnose and fix configuration issues.
Move Omni Defaults to JSONSchema
Omni default config values are now defined in the JSONSchema.
Direct Talos Node Access via SideroLink
All Talos nodes can now be accessed directly via their SideroLink endpoint, removing the need to route through the load balancer for Talos API calls. Allowing direct access to worker nodes when control plane nodes are unavailable.
Kubernetes Manifests Sync
Omni now supports syncing Kubernetes manifests directly to managed clusters. Manifests can be defined in cluster templates, allowing declarative management of Kubernetes resources alongside cluster configuration.
omnictl edit Command
A new omnictl edit command has been added, allowing users to edit Omni resources interactively from the CLI.
Allow Using talosctl debug
Update Omni Talos API proxy code to elevate permissions for talosctl debug command.
Workload Proxy Subdomain Options
The workload proxy now supports an empty subdomain configuration and a new useOmniSubdomain option, providing more flexibility in how workload proxy URLs are structured.
Contributors
- Edward Sammut Alessi
- Utku Ozdemir
- Artem Chernyshev
- Oguz Kilcan
- Andrey Smirnov
- Orzelius
- Dmitriy Matrenichev
- Hector Monsalve
- Justin Garrison
Changes
78 commits
- 5e912b14 release(v1.7.0): prepare release
- a25c5fde chore: prepare omni with talos v1.13.0-rc
- 77859611 chore: bump talos machinery
- 851d0e25 chore: bump deps
- 9afdc911 fix(frontend): open external eula link in a new tab
- 8933e716 release(v1.7.0-beta.1): prepare release
- cad37135 feat: implement eula guard for omni
- 0d92cc0d feat: allow force destroying machine requests
- 507becf1 feat: toggle info buttons if already opened
- db4f1d7d fix: attribute SA audit events to the performing admin
- 0773827c fix(frontend): disable workload proxy checkbox if disabled on instance
- f5aa0f72 fix: always set last error on manifests sync failure
- ba80cf6e fix: use resource definition's default namespace in omnictl get
- 131bd3a6 feat: allow using talosctl debug
- cf463639 feat: move config defaults into the JSON schema
- 53ed351d fix: evict per-machine cache entries before the cluster-wide entry
- 4352f3cb release(v1.7.0-beta.0): prepare release
- 9b09e8b0 fix: apply --force-context-name on initial kubeconfig creation
- 3251d142 fix: batch SQLite cleanup deletes to reduce write lock contention
- b6e3280a chore: bump go to v1.26.2
- 9201358b chore: bump dependencies and rekres
- e4760526 feat: support omnictl edit command
- 78bfa12a chore: collect metrics on the initial Collect call to avoid empty data
- 43be52c7 chore: bump sqlite metrics collector timeout and interval
- 5db4dbfa test: lock prepared for Omni upgrade cluster, then check pending changes
- 76d0c6a2 chore: extract sqlite metrics collector into a separate goroutine
- 68305854 chore(frontend

Omni 1.6.5 (2026-04-09)
Welcome to the v1.6.5 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
The deprecated flags and config fields that were kept for the SQLite migration period (introduced in v1.4.0) have been removed.
If you still have any of the following flags or config keys set, you must remove them before upgrading, as they will cause startup errors:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --log-storage-path (.logs.machine.storage.path)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
The automatic migration code for BoltDB secondary storage, file-based audit logs, file-based discovery service snapshots, and circular buffer machine logs has also been removed. If you are upgrading from a version older than v1.4.0, you must first upgrade to v1.4.x to complete the migrations, then upgrade to this version.
Contributors
- Andrey Smirnov
- Utku Ozdemir
- Oguz Kilcan
- Orzelius
- Artem Chernyshev
- Dmitriy Matrenichev
- Hector Monsalve
Changes
4 commits
- f81832d2 release(v1.6.5): prepare release
- 3640387a fix: batch SQLite cleanup deletes to reduce write lock contention
- 2c7de540 chore: bump go to v1.26.2
- bcf85902 chore: bump dependencies and rekres
Changes from siderolabs/crypto
1 commit
- 6d82f0c fix: bump minimum TLS version to v1.3
Changes from siderolabs/discovery-service
4 commits
- f1fdd95 release(v1.0.17): prepare release
- 2267f4c feat: store relative expiration (TTL) instead of absolute
- f708818 release(v1.0.16): prepare release
- 379016a feat: add option to disable client IP reporting in Hello response
Changes from siderolabs/go-kubernetes
5 commits
- 503792d chore: add retry to main kubernetes operations
- 6a00c4f feat: handle CR defined alongside their CRD in the same apply
- 4ff2602 feat: update deprecations to Kuberntes 1.36.0-beta.0
- 691a26b feat: add StateProvider for per-node COSI state in upgrade checks
- 92163c3 fix: set a the context logger
Changes from siderolabs/go-talos-support
2 commits
- 6ec24a7 feat: add per-node Talos client provider for support bundle collection
- 5e0155f fix: add trailing new line when writing to logger
Changes from siderolabs/grpc-proxy
3 commits
- d670c42 chore: bump dependencies
- 8614c71 chore: bump deps
- 80677e0 fix: propagate the headers before the message
Changes from siderolabs/proto-codec
1 commit
- 9b8a14e chore: bump dependencies
Changes from siderolabs/siderolink
1 commit
- 0a1933c chore: bump dependencies
Dependency Changes
- github.com/ProtonMail/gopenpgp/v2 v2.9.0 -> v2.10.0
- github.com/aws/aws-sdk-go-v2 v1.41.3 -> v1.41.5
- github.com/aws/aws-sdk-go-v2/config v1.32.11 -> v1.32.14
- github.com/aws/aws-sdk-go-v2/credentials v1.19.11 -> v1.19.14
- github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.6 -> v1.22.12
- github.com/aws/aws-sdk-go-v2/service/s3 v1.96.4 -> v1.98.0
- github.com/aws/smithy-go v1.24.2 -> v1.24.3
- github.com/cosi-project/runtime v1.14.0 -> v1.14.1
- github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
- github.com/google/go-containerregistry v0.21.2 -> v0.21.4
- github.com/hashicorp/vault/api v1.22.0 -> v1.23.0
- github.com/hashicorp/vault/api/auth/kubernetes v0.10.0 -> v0.12.0
- github.com/siderolabs/crypto v0.6.4 -> v0.6.5
- github.com/siderolabs/discovery-service v1.0.15 -> v1.0.17
- github.com/siderolabs/go-kubernetes 8364adde8878 -> v0.2.36
- github.com/siderolabs/go-talos-support v0.1.4 -> v0.2

Omni 1.6.4 (2026-04-02)
Welcome to the v1.6.4 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
The deprecated flags and config fields that were kept for the SQLite migration period (introduced in v1.4.0) have been removed.
If you still have any of the following flags or config keys set, you must remove them before upgrading, as they will cause startup errors:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --log-storage-path (.logs.machine.storage.path)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
The automatic migration code for BoltDB secondary storage, file-based audit logs, file-based discovery service snapshots, and circular buffer machine logs has also been removed. If you are upgrading from a version older than v1.4.0, you must first upgrade to v1.4.x to complete the migrations, then upgrade to this version.
Contributors
- Artem Chernyshev
Changes
2 commits
- 8cc2c4d6 release(v1.6.4): prepare release
- 4bea9686 chore: bump sqlite metrics collector timeout and interval
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.6.3

Omni 1.6.3 (2026-04-01)
Welcome to the v1.6.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
The deprecated flags and config fields that were kept for the SQLite migration period (introduced in v1.4.0) have been removed.
If you still have any of the following flags or config keys set, you must remove them before upgrading, as they will cause startup errors:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --log-storage-path (.logs.machine.storage.path)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
The automatic migration code for BoltDB secondary storage, file-based audit logs, file-based discovery service snapshots, and circular buffer machine logs has also been removed. If you are upgrading from a version older than v1.4.0, you must first upgrade to v1.4.x to complete the migrations, then upgrade to this version.
Contributors
- Artem Chernyshev
Changes
3 commits
- 88565b0f release(v1.6.3): prepare release
- b71f8507 chore: collect metrics on the initial Collect call to avoid empty data
- 7783277e chore: extract sqlite metrics collector into a separate goroutine
Dependency Changes
- golang.org/x/crypto v0.48.0 -> v0.49.0
- golang.org/x/net v0.51.0 -> v0.52.0
- golang.org/x/text v0.34.0 -> v0.35.0
- google.golang.org/grpc v1.79.2 -> v1.80.0
Previous release can be found at v1.6.2

Omni 1.6.2 (2026-03-25)
Welcome to the v1.6.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
The deprecated flags and config fields that were kept for the SQLite migration period (introduced in v1.4.0) have been removed.
If you still have any of the following flags or config keys set, you must remove them before upgrading, as they will cause startup errors:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --log-storage-path (.logs.machine.storage.path)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
The automatic migration code for BoltDB secondary storage, file-based audit logs, file-based discovery service snapshots, and circular buffer machine logs has also been removed. If you are upgrading from a version older than v1.4.0, you must first upgrade to v1.4.x to complete the migrations, then upgrade to this version.
Contributors
- Edward Sammut Alessi
Changes
2 commits
- 749c9921 release(v1.6.2): prepare release
- 84149d69 fix(frontend): prevent invalid auth state
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.6.1

Omni 1.6.1 (2026-03-19)
Welcome to the v1.6.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
The deprecated flags and config fields that were kept for the SQLite migration period (introduced in v1.4.0) have been removed.
If you still have any of the following flags or config keys set, you must remove them before upgrading, as they will cause startup errors:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --log-storage-path (.logs.machine.storage.path)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
The automatic migration code for BoltDB secondary storage, file-based audit logs, file-based discovery service snapshots, and circular buffer machine logs has also been removed. If you are upgrading from a version older than v1.4.0, you must first upgrade to v1.4.x to complete the migrations, then upgrade to this version.
Contributors
- Oguz Kilcan
- Andrey Smirnov
- Artem Chernyshev
- Utku Ozdemir
Changes
8 commits
- 44562c97 release(v1.6.1): prepare release
- 1b7fa208 fix: correct SQLite size metrics to include indexes and freelist
- 0b1e9ea0 fix: fix panics in diff algorithms
- d7ec007b fix: use dynamic SQLite pool
- 3c6dd0ee fix: track load balancer port allocations in-memory
- e2248065 fix: load balancer health status diff and stopped status race
- 079e28c7 chore: export the SQLite memory allocator stats
- e7dfbc9c fix: add omnictl backward compatibility with older Omni servers
Dependency Changes
- github.com/cosi-project/state-sqlite v0.3.0 -> v0.4.0
Previous release can be found at v1.6.0

Omni 1.6.0 (2026-03-16)
Welcome to the v1.6.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
The deprecated flags and config fields that were kept for the SQLite migration period (introduced in v1.4.0) have been removed.
If you still have any of the following flags or config keys set, you must remove them before upgrading, as they will cause startup errors:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --log-storage-path (.logs.machine.storage.path)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
The automatic migration code for BoltDB secondary storage, file-based audit logs, file-based discovery service snapshots, and circular buffer machine logs has also been removed. If you are upgrading from a version older than v1.4.0, you must first upgrade to v1.4.x to complete the migrations, then upgrade to this version.
Talos and Kubernetes CA Rotation
Omni now supports rotating the Talos and Kubernetes Certificate Authorities for managed clusters.
Talos and Kubernetes Versions in ClusterStatus
The ClusterStatus resource now includes talos_version and kubernetes_version fields, making cluster version information available programmatically. They are now also shown in the cluster list in the UI.
Pending and Historical Config Diffs in UI
The UI now shows pending and historical configuration diffs, making it easy to review what changed and when.
diffs
Force Machine Destroy
A --force flag has been added to the machine destroy command (and a corresponding UI option) to forcibly remove machines that are stuck or unresponsive.
Helm Chart v2
A new Helm chart v2 has been implemented with improved structure and more configurable options.
More configuration values are now exposed in the Helm chart, giving operators greater flexibility when deploying Omni.
Installation Media Wizard
The installation media flow now uses a wizard-based UI by default, replacing the previous modal dialog. Presets may now also be saved, allowing for future reuse.
wizard
Machine Log Storage Cleanup
Global size-based cleanup has been added for machine log storage, preventing unbounded disk usage.
Configurable options for audit log cleanup have also been added.
Minimum Talos Version Bump
The minimum supported Talos version for new clusters has been bumped to 1.8.
Minor UI Improvements
Other minor UI improvements part of this release:
- Talos and Kubernetes versions are now shown in the cluster list.
- Node name and UUID are shown in the support bundle modal.
- Machine set pools now have a collapse/expand toggle.
- Cluster scaling has been moved to a modal dialog.
- Getting started guidance and empty-state pages have been added for clusters, machines, and machine classes.
- Instructions for adding machines and exporting cluster templates are now shown in the UI.
- Clarification text has been added to backup settings.
- YouTube video embedding is now supported in documentation/onboarding flows.
- The frontend authentication flow no longer requires an explicit login click.
- Resource labels use new colors for improved visual clarity.
Detailed Node Disk Information
The node details page now shows detailed disk information, including disk model, size, and type.
disks
PCI Devices on Node Details
The node details page now includes a dedicated section listing all PCI devices present on the node.
devices
Reset Node Unique Tokens
It is now poss

Omni 1.5.11 (2026-03-13)
Welcome to the v1.5.11 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
- Artem Chernyshev
- Edward Sammut Alessi
Changes
4 commits
- 6dfaae01 release(v1.5.11): prepare release
- b2cecc32 feat: add hsts header for omni frontend
- 4de2c801 fix: add missing timeout to the backup download calls in secrets ctrl
- c762a8fe fix: bring in the new chart correctly to release-1.5
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.10

Omni 1.5.10 (2026-03-11)
Welcome to the v1.5.10 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
- Utku Ozdemir
Changes
3 commits
- 143d9533 release(v1.5.10): prepare release
- 293836a6 test: fix ConfigPatching test
- 941bba6b fix: do not release lock on apply config fails
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.9

Omni 1.5.9 (2026-03-09)
Welcome to the v1.5.9 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
Changes
3 commits
- cf10a6c4 release(v1.5.9): prepare release
- 74dc90dd fix: prevent controller feedback loop for invalid schematic machines
- 52d15d3d fix: prevent unwanted upgrades of non-image-factory machines
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.8

Omni 1.5.8 (2026-02-27)
Welcome to the v1.5.8 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Andrey Smirnov
- Kevin Tijssen
- Noel Georgi
- Artem Chernyshev
- Mateusz Urbanek
- Orzelius
- Oguz Kilcan
- Tim Jones
- Daddie0
- Dmitrii Sharshakov
- greenpsi
Changes
2 commits
- 311657f3 release(v1.5.8): prepare release
- 865e60da chore: bump deps, rekres and fix linters
Changes from siderolabs/discovery-api
2 commits
- 9c06846 feat: change the way excluded addresses are specified
- f71a14a feat: add advertised filters to discovery data
Changes from siderolabs/discovery-client
2 commits
- 854400f feat: bump discovery API to v0.1.8
- 0a4c6fd chore: update dependencies and rekres
Changes from siderolabs/discovery-service
2 commits
- 8863fd8 release(v1.0.14): prepare release
- e0c8062 chore: rekres and update dependencies
Changes from siderolabs/go-debug
1 commit
- 47fce68 feat: support Go 1.26, rekres
Changes from siderolabs/go-kubernetes
9 commits
- a95f3bf chore: add helper functions for CLI applications
- f2c063b test: add integration tests for ssa logic
- 9de92cf refactor: drop k8s.io/utils
- 8e6f068 fix: bring back legacy sync
- de675a0 fix: stop using custom dialer for Kubernetes client
- e7a89c3 refactor: use fluxcd/ssa instead of kubernetes cli-utils for ssa
- 0a235c0 feat: add early support for Kubernetes 1.36
- 3bea212 fix: use new Myers diff algorithm
- 604c56b chore: extract common code to the go-kubernetes package
Changes from siderolabs/image-factory
37 commits
- f0c7a7b release(v1.0.3): prepare release
- dd92631 docs: correct path to hack/copy-artifacts.sh
- ddc1a83 fix: update Talos to fix rpi_5 build
- b3d07e5 docs: remove redundant Kubernetes version prerequisite
- 9666795 fix: values.schema.json
- 8a8da46 feat: adjust security context for user namespace mode
- bc631dc fix: values.schema.json
- 8ea6fe9 feat: add user namespace support with Kubernetes version validation
- 324c464 fix: skip initializing TUF if keyless signing is disabled
- a42b9d9 release(v1.0.2): prepare release
- 80d1ba3 fix: pass nameoptions to verify bundle too
- eec01d1 release(v1.0.1): prepare release
- ec1c0a7 fix: pass insecure to the cosign new bundle verifier
- 14d0f2a release(v1.0.0): prepare release
- a90529c feat: add more security contexts
- ec69fe2 fix: extra kernel args for overlays
- aa325ee feat: add Helm docs and schema
- 3c18e05 feat: add Sidero google service account email also to verfiers
- 151feb5 fix: docs url
- 42a1c45 feat: add helm to kres
- ac4718a feat: update Talos and pkgs
- 1d6468e feat: add helm e2e to CI
- 2f0499c feat: added e2e tests
- 2eccf98 fix: made changes on the recommendation of copilot
- e27ea36 feat: Added E2E with KUTTL
- 9f6b9e7 feat: Added additional tests
- 4939747 feat: Added helm unittests
- dcaa1db feat: added helmchart
- 1f85622 feat: add cloudflare credentials helper
- 852856d fix: installer internal config
- c8c6576 release(v1.0.0-beta.0): prepare release
- 56bd21b fix: allow Cache-Control header in CORS
- 83f4d91 fix: clarify bootloader selection
- c8c5faa feat: allow using image GET/HEAD API by the JS code on any domains
- e732d90 feat: support acm for secureboot
- 5f103c1 feat: support copying to clipboard
- c3532c4 feat: update Talos with GRUB and other fixes
Changes from siderolabs/kms-client
3 commits
- 296bf9a feat: add logging to the KMS server
- 2d6b082 feat: add TLS support for KMS server
- 4233ecd chore: bump deps, rekres
Dependency Changes
- github.com/aws/aws-sdk-go-v2 v1.41.1 -> v1.41.2
- github.com/aws/aws-sdk-go-v2/config v1.32.7 -> v1.32.10
- github.com/aws/aws-sdk-go-v2/credentials v1.19.7 -> v1.19.10
- github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.19 -> v1.22.4
- github.com/aws/aws-sdk-go-v2/service/s3 v1.95.1 -> v1.96.2
- github.com/aws/smithy-go v1.24.0 -> v1.24.1
- github.com/cosi-project/runtime 2b3357ea6788 -> v1.14.0
- github.com/google/go-containerregistry v0.20.7 -> v0.21.1
- 

Omni 1.5.7 (2026-02-25)
Welcome to the v1.5.7 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
2 commits
- e83051fa release(v1.5.7): prepare release
- 1959a4e8 feat: allow resetting node unique tokens
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.6

Omni 1.5.6 (2026-02-24)
Welcome to the v1.5.6 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
- Edward Sammut Alessi
Changes
2 commits
- 92ecc79f release(v1.5.6): prepare release
- 9ab50e4b feat(frontend): allow embedding youtube videos
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.5

Omni 1.5.5 (2026-02-20)
Welcome to the v1.5.5 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
2 commits
- 4defffc8 release(v1.5.5): prepare release
- f005f848 chore: bump Talos machinery to the latest main and use 1.12.4 schema
Dependency Changes
- github.com/emicklei/dot v1.10.0 -> v1.11.0
- github.com/siderolabs/talos/pkg/machinery b9e27ebe72c4 -> e00aed0f6694
- go.yaml.in/yaml/v4 v4.0.0-rc.3 -> v4.0.0-rc.4
- golang.org/x/crypto v0.47.0 -> v0.48.0
- golang.org/x/net v0.49.0 -> v0.50.0
- golang.org/x/text v0.33.0 -> v0.34.0
Previous release can be found at v1.5.4

Omni 1.5.4 (2026-02-18)
Welcome to the v1.5.4 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
Changes
2 commits
- 8fa3caf4 release(v1.5.4): prepare release
- b38d89b3 fix: compare current and new kernel args more defensively
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.3

Omni 1.5.3 (2026-02-17)
Welcome to the v1.5.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
- Artem Chernyshev
Changes
3 commits
- 9b46d417 release(v1.5.3): prepare release
- ee1fc5f3 fix: break the dep loop in the cluster machine config status controller
- 329926cd fix: fix schematic generation for machines in agent mode
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.2

Omni 1.5.2 (2026-02-12)
Welcome to the v1.5.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
- Utku Ozdemir
Changes
2 commits
- 348ea65f release(v1.5.2): prepare release
- 309b3501 fix: replace gotextdiff with linear-space Myers diff to prevent OOM
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.1

Omni 1.5.1 (2026-02-11)
Welcome to the v1.5.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
3 commits
- 0de60cd3 release(v1.5.1): prepare release
- 908d738c fix: properly generate upgrade diffs for the imported cluster
- 86f33f83 fix: fix memory leak in the config diff compute code
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.5.0

Omni 1.5.0 (2026-02-05)
Welcome to the v1.5.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Better Audit Logging
Omni now collects audit logs for operations performed on all user-managed resources, improving security and traceability.
Config Generation
Omni can now generate its own configuration directly from the defined schema.
The config merge algorithms were also improved: now the config preserves the default values properly when some sections are
overwritten by the user provided config.
Etcd Maintenance
The following etcd commands are now usable with Omni managed clusters:
talosctl etcd downgrade validate
talosctl etcd downgrade enable
talosctl etcd downgrade cancel
talosctl etcd forfeit leadership
gRPC Tunnel Management
Added the ability to switch gRPC tunnel modes for connected machines.
Join Token Management
Added a dedicated omnictl jointoken omni-endpoint to streamline node registration.
Kernel Args CLI Tools
Added support for managing kernel arguments directly within cluster templates.
Schema-Aware Code Editor
The built-in code editor for the machine configs now supports different configuration schemas for each Talos version.
So the config will be always validated against the currently running Talos version schema.
omnictl Directory Support
The omnictl sync/apply can now process directories, simplifying bulk resource applications.
WireGuard Bind Address
The WireGuard endpoint (services.siderolink.wireGuard.endpoint / --siderolink-wireguard-bind-addr) is now respected. Previously, Omni always bound to all interfaces regardless of this setting. Default remains 0.0.0.0:50180.
Contributors
- Edward Sammut Alessi
- Utku Ozdemir
- Andrey Smirnov
- Oguz Kilcan
- Artem Chernyshev
- Noel Georgi
- Pranav Patil
- Orzelius
- Laura Brehm
- Aleksandr Gamzin
- Brant Gurganus
- Justin Garrison
- Mateusz Urbanek
- Spencer Smith
- Utku Ozdemir
Changes
125 commits
- c27f8d39 release(v1.5.0): prepare release
- 277c946b fix: prevent unwanted upgrades of non-image-factory machines (backport)
- 9b05243c fix: pause cluster machine watches until expanded
- 6a37b31a fix: check config generation errors before computing redacted configs
- 515701af release(v1.5.0-beta.2): prepare release
- 2aabc02a chore: rekres
- 3a7c9278 chore: rekres to disable helm doc generation step
- c241820e fix: apply AccessPolicy rules on gRPC proxy for Talos backend
- 587356b3 fix: stop generating node unique token in NodeUniqueTokenStatus
- 85ff13f9 feat(installation-media): add step validation to installation media wizard
- 0b33cf8e feat(installation-media): select defaults for each form step
- 8f1eb588 refactor(frontend): extract route.name into a computed ref
- 0d5d7da6 feat: allow multiple --config-path flags for config merging
- 056d5e4e fix: bind wireguard to configured address instead of all interfaces
- 7376edaf fix(installation-media): fix bug when setting arch to amd64
- c3c483d7 fix(installation-media): clarify bootloader section
- 9bcd356c fix: don't submit empty machine labels to create schematic
- 46de2c3a chore: enable no-explicit-any in frontend and fix errors
- d20fd8f0 chore: rekres and generate-frontend
- bc7725f7 feat(installation-media): implement edit preset functionality
- 77a32346 refactor(installation-media): move form state to its own composable
- fe713e94 release(v1.5.0-beta.1): prepare release
- 49788342 test: fix failing workload proxy tests
- a5795c2f feat: add config descriptions in schema, use them in flags
- 883fadfe feat(installation-media): add review page for installation media
- db1b969b refactor(frontend): refactor config patch edit
- d12c92c0 feat(installation-media): allow skipping/jumping between steps
- 993097ae fix: fix tmenuitem to not lose reactivity from props
- 98ef83ee fix: fix config patches encryption when encryption is disabled
- aafc74f9 chore: update packages
- c87c952e refactor(frontend): rekres and use request error from fetch.pb.ts
- 0f8a

Omni 1.4.9 (2026-02-06)
Welcome to the v1.4.9 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Edward Sammut Alessi
- Utku Ozdemir
Changes
2 commits
- d38be3fb release(v1.4.9): prepare release
- 0108d1e4 fix: prevent unwanted upgrades of non-image-factory machines (backport)
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.8

Omni 1.4.8 (2026-02-04)
Welcome to the v1.4.8 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Edward Sammut Alessi
- Artem Chernyshev
- Oguz Kilcan
- Utku Ozdemir
- Utku Ozdemir
Changes
7 commits
- 93e71058 release(v1.4.8): prepare release
- df8b9462 fix: open OIDC plugin link in a new tab
- 26e6d991 fix(frontend): keep correct auth flow for cli/workload
- 3959a0f1 fix: apply AccessPolicy rules on gRPC proxy for Talos backend
- 1a11c1d0 feat: clean up orphaned machine logs from sqlite
- dd635009 fix: pause cluster machine watches until expanded
- 450a7fe5 fix: stop generating node unique token in NodeUniqueTokenStatus
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.7

Omni 1.4.7 (2026-01-06)
Welcome to the v1.4.7 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Edward Sammut Alessi
- Artem Chernyshev
Changes
4 commits
- ed9a9662 release(v1.4.7): prepare release
- e89f08b0 fix: set secureboot for image correctly from download modal
- 3a957d40 fix(frontend): allow selecting all download options for omnictl
- bffbb42d release(v1.4.6): prepare release
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.6

Omni 1.4.6 (2025-12-26)
Welcome to the v1.4.6 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Artem Chernyshev
Changes
4 commits
- 020ba61c fix: ignore labeled MachineSetNodes in the UI same way as for CLI
- e4bc9fc7 release(v1.4.5): prepare release
- fa0b3747 chore: bump API version to 2 as old CLI is no longer 100% compatible
- 63eeb259 fix: ignore labeled MachineSetNodes in the export and sync CLI cmds
Changes since v1.4.5
1 commit
- 020ba61c fix: ignore labeled MachineSetNodes in the UI same way as for CLI
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.4

Omni 1.4.5 (2025-12-23)
Welcome to the v1.4.5 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Artem Chernyshev
Changes
3 commits
- e4bc9fc7 release(v1.4.5): prepare release
- fa0b3747 chore: bump API version to 2 as old CLI is no longer 100% compatible
- 63eeb259 fix: ignore labeled MachineSetNodes in the export and sync CLI cmds
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.4

Omni 1.4.4 (2025-12-23)
Welcome to the v1.4.4 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Andrey Smirnov
Changes
2 commits
- bfb124a9 release(v1.4.4): prepare release
- 2bbd9d79 fix: run more aggressive compaction for sqlite/metrics
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.3

Omni 1.4.3 (2025-12-22)
Welcome to the v1.4.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Artem Chernyshev
Changes
2 commits
- 2af41224 release(v1.4.3): prepare release
- d00ba7eb fix: get rid of an exception in the UserInfo
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.2

Omni 1.4.2 (2025-12-19)
Welcome to the v1.4.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Utku Ozdemir
Changes
2 commits
- ab5161f1 release(v1.4.2): prepare release
- c202d347 fix: implement size-based machine logs cleanup
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.1

Omni 1.4.1 (2025-12-19)
Welcome to the v1.4.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
It must be a path to the SQLite file (will be created by Omni), not a directory, e.g., --sqlite-storage-path=/path/to/omni-sqlite.db.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Contributors
- Utku Ozdemir
Changes
2 commits
- 0786003e release(v1.4.1): prepare release
- 14d0e6c1 fix: prevent audit logs migration from getting stuck
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.4.0

Omni 1.4.0 (2025-12-16)
Welcome to the v1.4.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)
This release consolidates Discovery service state, Audit logs, Machine logs, and Secondary resources into a single SQLite storage backend.
1. New Required Flag
You must set the new --sqlite-storage-path (or .storage.sqlite.path) flag. There is no default value, and Omni will not start without it.
2. Audit Logging Changes
A new flag --audit-log-enabled (or .logs.audit.enabled) has been introduced to explicitly enable or disable audit logging.
- Default: true.
- Change: Previously, audit logging was implicitly enabled only when the path was set. Now, it is enabled by default.
3. Automatic Migration
Omni will automatically migrate your existing data (BoltDB, file-based logs) to the new SQLite database on the first startup. To ensure this happens correctly, simply add the new SQLite flag and leave your existing storage flags in place for the first run.
Once the migration is complete, you are free to remove the deprecated flags listed below. If they remain, they will be ignored and eventually dropped in future versions.
4. Deprecated Flags (Kept for Migration)
The following flags (and config keys) are deprecated and kept solely to facilitate the automatic migration:
- --audit-log-dir (.logs.audit.path)
- --secondary-storage-path (.storage.secondary.path)
- --machine-log-storage-path (.logs.machine.storage.path)
- --machine-log-storage-enabled (.logs.machine.storage.enabled)
- --embedded-discovery-service-snapshot-path (.services.embeddedDiscoveryService.snapshotsPath)
- --machine-log-buffer-capacity (.logs.machine.bufferInitialCapacity)
- --machine-log-buffer-max-capacity (.logs.machine.bufferMaxCapacity)
- --machine-log-buffer-safe-gap (.logs.machine.bufferSafetyGap)
- --machine-log-num-compressed-chunks (.logs.machine.storage.numCompressedChunks)
5. Removed Flags
The following flags have been removed and are no longer supported:
- --machine-log-storage-flush-period (.logs.machine.storage.flushPeriod)
- --machine-log-storage-flush-jitter (.logs.machine.storage.flushJitter)
Support for OIDC Providers without Email Verified Claim
Enabled support for OIDC providers, such as Azure, that do not provide the email_verified claim during authentication.
Dynamic SAML Label Role Updates
Added support for dynamically updating SAML label roles on every login via the new update_on_each_login field.
Machine Class Logic Updates
Added support for locks, node deletion, and restore operations when using machine classes.
Virtual Resources for Platform Information
Platform and SBC information is now pulled from Talos machinery and presented as virtual resources:
MetalPlatformConfig, CloudPlatformConfig, and SBCConfig. They support Get and List operations.
Automated CLI Install Options
Automated installation options have been added to the CLI section of the homepage, supplementing the existing manual options.
OIDC Warning for Kubeconfig Download
A warning toast is now displayed when downloading kubeconfig to inform users that the OIDC plugin is required before using the file with kubectl.
UI/UX Improvements
Various UI improvements including pre-selecting the correct binary for the user's platform, truncating long items in the ongoing tasks list,
hiding JSON schema descriptions behind tooltips, and standardizing link styling.
Force Deletion of Infra Provider Resources
Added the ability to force-delete MachineRequests and InfraMachines managed by Infra providers.
This allows for the cleanup of resources and finalizers even if the underlying provider is unresponsive or deleted.
Prevent Talos Minor Version Downgrades
Omni now prevents downgrading the Talos minor version below the initial version used to create the cluster.
This safeguard prevents machine configurations from entering a broken state due to unsupported feat

Omni 1.3.4 (2025-11-20)
Welcome to the v1.3.4 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
2 commits
- f8694b22 release(v1.3.4): prepare release
- 807b218b chore: remove nonce from the index.html
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.3.3

Omni 1.3.3 (2025-11-20)
Welcome to the v1.3.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
- Oguz Kilcan
- Utku Ozdemir
- Artem Chernyshev
Changes
9 commits
- 0558c18b release(v1.3.3): prepare release
- ef68e7db test: pick UKI and non-UKI machines correctly
- 1e6843f7 test: remove nonce CSP header test
- 85bf6a6d fix: do not allow downloading deprecated Talos versions in the UI
- 8fa28e76 refactor: use template instead of bytes replace for nonce
- f648ba20 fix: add nonce for userpilot scripts
- 145a3ae5 fix(frontend): keep use_embedded_discovery_service state when scaling
- 1b92fd1e fix: fix typos across the project
- ef9c9861 fix: do not clear schematic meta values for non-UKI machines
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.3.2

Omni 1.3.2 (2025-11-14)
Welcome to the v1.3.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
- Artem Chernyshev
- Edward Sammut Alessi
Changes
9 commits
- 0b9a38a1 release(v1.3.2): prepare release
- 42848316 fix(frontend): fix exposed services sidebar not appearing
- 5dfe4d55 fix: reduce usage of cached state to avoid stale reads
- becf6bd6 test: fix flaky etcd backup tests
- 11f3b039 test: fix flaky MachineUpgradeStatusController test
- d7dc7788 fix: use deterministic order for machine extensions
- 8df8997a fix: keep existing cluster level system extensions config in the UI
- 394efd91 fix: ignore MachineSets which reference non-existing clusters
- 04f2f465 fix(frontend): remove double scrollbar on machines list
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.3.1

Omni 1.3.1 (2025-11-07)
Welcome to the v1.3.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
- Edward Sammut Alessi
Changes
4 commits
- 58332e84 release(v1.3.1): prepare release
- 35d75747 fix: prevent MachineSetStatus from going into create/destroy loop
- cf3c84e1 fix: do not skip creating schematic config in agent mode
- 50f6c048 fix(frontend): only show label outline if selected
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.3.0

Omni 1.3.0 (2025-11-07)
Welcome to the v1.3.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Shortened Auth0 Token Lifetime
Auth0 authentication tokens now expire after 2 minutes. Users without valid PGP keys will need to reauthenticate once tokens expire.
Cluster Import (Experimental)
Omni introduces an experimental feature that allows users to import existing Talos clusters to be managed by Omni.
Documentation on how to use this feature can be found here: https://docs.siderolabs.com/omni/cluster-management/importing-talos-clusters
Multi-Select for Pending Machines
You can now accept or reject multiple pending machines at once, simplifying large-scale approvals.
Stripe Link in Settings Sidebar
A Stripe link is now shown in the Omni settings sidebar when Stripe integration is enabled.
Display Unsupported Kubernetes Versions
Unsupported Kubernetes versions are now shown in the update modal as disabled entries with explanatory messages.
Improved Kubernetes Update Modal
The Kubernetes update modal now displays only upgradeable minor versions and explains why certain versions are not upgradeable.
Enhanced CPU Information in Machine Status
Machines now report processor details when either core count or frequency is available, improving visibility into hardware specs.
Support for Modifying Kernel Arguments
Omni now supports modifying kernel arguments for the existing machines.
Documentation on how to use this feature can be found here: https://docs.siderolabs.com/omni/infrastructure-and-extensions/modify-kernel-arguments
Contributors
- Edward Sammut Alessi
- Utku Ozdemir
- Artem Chernyshev
- Oguz Kilcan
- Andrey Smirnov
- Justin Garrison
- Noel Georgi
- niklasfrick
- niklasfrick
Changes
88 commits
- 3a47a7ee release(v1.3.0): prepare release
- 4b81c5e5 fix: remove KernelArgs resource when a machine is removed
- e51ef57a test: fix install extra kernel args in infra test
- 8a24c83d fix: update MachineRequestStatus resource when we populate UUID
- a3d47dae chore: expose enable-talos-pre-release-versions flag in the FeaturesConfig
- a1ab057b release(v1.3.0-beta.2): prepare release
- 13af8506 fix: prevent stale reads of kernel args in schematic id calculation
- a243fa88 fix(frontend): never add install disk for default disk
- af202c46 refactor(frontend): create a docs link generator
- 084e813a refactor(frontend): refactor tselectlist with reka-ui
- 0aba0fc7 fix(frontend): ignore invalid signature error on logout
- 516d2deb feat: permit MetaWrite/MetaDelete Talos APIs
- bacf80b5 refactor(frontend): introduce tw-animate-css
- 74a20773 release(v1.3.0-beta.1): prepare release
- 3f2021b0 fix(frontend): remove network error toasts
- 31d42130 fix: remove non-machinery Talos import, fix changelog
- bb582359 release(v1.3.0-beta.0): prepare release
- c2cbf34b fix: get rid of an extra call of the final provision step
- ff79e024 feat(installation-media): replace modal with link
- 8dde49d4 refactor(frontend): replace .prettierrc with prettier.config.ts
- 9d3ae445 chore(frontend): update node to latest lts
- a6da9dbf feat(installation-media): add placeholder steps
- afbc02f6 feat(installation-media): integrate stepper into create page
- 15deddde feat: implement extra kernel args support
- 832beba9 fix: change the order of operations in the common infra provider lib
- f70d78ee fix: make sidebar menus which do not open routes expand the submenus
- 52234c15 fix(frontend): add missing gap in some modals
- 0fa7d0a5 fix(frontend): only clamp min/max tinput values on blur
- 9794f6f0 fix(frontend): correct the icon colors on tstatus
- 02425267 test: improve integration tests
- a91eabdf fix: make sure that machine state is never nil in deprovision calls
- 4e120167 fix: properly check tracking state to show user consent form
- 25d58187 feat(installation-media): add initial page for creating installation media
- d9c41f11 feat(installation-media): add a stepper component
- 6d941f8a fix: remo

Omni 1.2.1 (2025-10-02)
Welcome to the v1.2.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Oguz Kilcan
Changes
2 commits
- 5e0a1335 release(v1.2.1): prepare release
- 9cfcc245 fix: remove dangling cluster taints
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.2.0

Omni 1.2.0 (2025-09-30)
Welcome to the v1.2.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Cluster Locking
Cluster locking is a feature that pauses/disables all cluster related operations on a cluster.
Visual Feedback on Copy
Added visual feedback when copying text to the clipboard.
Generate Join Config for a Specific Join Token
Added the ability to generate a join configuration for a specific join token.
kubeconfig with grant-type=authcode-keyboard
New configs generated with the latest Omni version and authcode-keyboard
enabled now work for oidc-login v1.33+.
See int128/kubelogin#1263
Newly generated configs won't work for oidc-login below v1.33. You can:
- keep using the old configs.
- generate the new configs and drop oidc-redirect-url param.
- update the oidc-login module.
Redesigned Machine List Page
The Machines list page has been redesigned to provide a better user experience.
Minimum Talos version for new clusters
The minimum Talos version required to create new clusters has been raised to v1.6.0.
New exported metrics for cluster features and machine details
New prometheus metrics are added for:
- Enabled cluster features: disk encryption, embedded discovery service, workload proxying.
- Machines' platforms, their secure boot status and whether they were booted with UKI.
OIDC Authentication Support
Added support for OIDC authentication in Omni.
Toast Messages
Replaced the notification banner feature with toast messages.
User Consent Form for Userpilot
Added a user consent form for Userpilot to allow opting in/out for data collection.
Userpilot Reporting Integration
Integrated Userpilot reporting to help track user interactions.
Contributors
- Edward Sammut Alessi
- Oguz Kilcan
- Utku Ozdemir
- Andrey Smirnov
- Artem Chernyshev
- Mateusz Urbanek
- Noel Georgi
- Orzelius
Changes
77 commits
- ea874abe release(v1.2.0): prepare release
- 75593be6 chore: bump min Talos version
- 5e9b7e2f release(v1.2.0-beta.3): prepare release
- 0a30aea6 fix(frontend): adjust spacing of items in infraproviders
- 3f1b96d4 test: fix the data race in TestEtcdElectionsLost
- 17d03943 feat: add more cluster and machine metrics
- 442e0a25 chore: add codeowners file
- 48daa1e2 refactor: resource server runtimes
- d060544c refactor: remove listitembox
- ad9481c0 refactor: simplify tslidedownwrapper
- 9a13ba57 release(1.2.0-beta.2): prepare release
- 10829faf fix: fix local resource server access auth check
- 789913ff fix: adjust the grid alignment for clusters to have all phases lined up
- ff35c35a fix: alignment of oidc login not being centered
- d2158773 release(v1.2.0-beta.1): prepare release
- 5beb24f7 fix: fix the order in the grpc interceptor chain
- ecb9e7d1 fix: add oidc-redirect-url arg to the generated kubeconfigs
- 958d1ee0 fix: inline the css from clusters-grid
- 7856de3e fix: use correct indentation in the generate-certs scripts
- d01738ea test: introduce msw to mock api calls
- b801f688 test: query string for saml login is forwarded
- 120d9b24 chore: colocate tests with their tested components
- dbe39ea1 feat: check on start up if the account has Talos < 1.6 and strict tokens
- 99f1506f fix: keep query parameters encoded in the oidc/saml login flows
- a1cd4729 chore: use storage composables from vueuse
- 4c03a10a chore: replace hardcoded colors with vars
- 95f1f879 chore: improve e2e selectors
- db939c6e release(1.2.0-beta.0): prepare release
- 1f098cfa test: improve test cluster creation for e2e tests
- a035908a test: write more comprehensive e2e tests for home page
- 21cd3915 chore: rekres and fix e2e test runs
- 900e5e95 chore: strip comments from generated ClusterMachineConfig
- 5ab4fe41 chore: migrate omni e2e tests to javascript
- ca93da3e fix: fix switch user button for Auth0
- fbf89ac5 test: fix cluster-import e2e test
- 58217d6f feat: implement user consent form for the UserPilot
- 1b4de5b7 feat: abort ongoing cluster import process
- 39089938 fix: use

Omni 1.1.5 (2025-09-23)
Welcome to the v1.1.5 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Utku Ozdemir
- Artem Chernyshev
- Oguz Kilcan
Changes
8 commits
- 8505bfa6 release(v1.1.5): prepare release
- 243abea7 fix: fix local resource server access auth check
- 8242b619 test: bring in the GHA runner changes and compatible talosctl version
- 1396083f fix: fix the order in the grpc interceptor chain
- 01811621 fix: add oidc-redirect-url arg to the generated kubeconfigs
- 9ef83771 fix: use correct order to determine SideroV1 keys directory path
- e47b8615 fix: keep query parameters encoded in the oidc/saml login flows
- 30895722 chore: allow more than one commit for a PR
Changes from siderolabs/go-api-signature
1 commit
- 68478e2 fix: return invalid signature error when a signature is required
Dependency Changes
- github.com/siderolabs/go-api-signature v0.3.7 -> v0.3.8
Previous release can be found at v1.1.4

Omni 1.1.4 (2025-09-09)
Welcome to the v1.1.4 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
2 commits
- 54397941 release(v1.1.4): prepare release
- 4be8e10c fix: do not make not running lazy workload proxy healthchecker block
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.1.3

Omni 1.1.3 (2025-09-01)
Welcome to the v1.1.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
Changes
2 commits
- 563b3a57 release(v1.1.3): prepare release
- af9fd360 fix: fix copy buttons on omni home page
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.1.2

Omni 1.1.2 (2025-08-29)
Welcome to the v1.1.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Oguz Kilcan
Changes
2 commits
- 739ec54b release(v1.1.2): prepare release
- 7bcea756 test: use clustermachineconfig sha for omni upgrade e2e test
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.1.1

Omni 1.1.1 (2025-08-28)
Welcome to the v1.1.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Edward Sammut Alessi
Changes
2 commits
- 2ac9ed1b release(v1.1.1): prepare release
- 07d4cec7 fix: make useWatch respect reactivity
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.1.0

Omni 1.1.0 (2025-08-27)
Welcome to the v1.1.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Improved Clusters Page Breadcrumbs
Breadcrumbs on the clusters page have been redesigned for better navigation.
CLI Support for Kernel Args and Join Configs
omnictl now supports commands to retrieve SideroLink kernel arguments and join configurations.
Default Config Location Change
The default location for storing Omni configuration files and user PGP keys has been changed.
Custom Volumes in Helm Chart
Added support for specifying custom volumes and volume mounts in the Omni Helm chart.
Home Page Design Update
Omni home page design was changed to have more useful information about the whole account status.
Join Token Usage Warning
Omni now warns users when a join token is currently in use during revoke or delete operations.
Collapsible Sidebar on Mobile
The sidebar can now be collapsed when viewed on mobile devices, improving usability on smaller screens.
Join Tokens CLI
A new CLI feature has been added to manage SideroLink join tokens directly using omnictl.
Unique Token Status per Node
Omni now computes and displays a unique join token status for each node.
Contributors
- Andrey Smirnov
- Edward Sammut Alessi
- Oguz Kilcan
- Mateusz Urbanek
- Artem Chernyshev
- Noel Georgi
- Utku Ozdemir
- Thomas Gosteli
Changes
42 commits
- 904ff163 release(v1.1.0): prepare release
- e92c3415 feat: home page redesign
- 587ac1bc fix: add missing card styles to machines list
- f56eaff6 chore: improve useWatch typings
- c9657cbb feat: add jitter and lazy health checks to exposed services
- 979f30de fix: fix alignment issue with TButton
- 98d2e409 release(v1.1.0-beta.0): prepare release
- 9daa2fa2 chore: create a useWatch composable
- 7ae7ea74 chore: rekres, bump deps, Go, satisfy linters
- 152db8fe feat: change default location for storing Omni config and user PGP keys
- 36430a26 feat: add custom volume and custom volume mount support for omni helm chart
- 150d61bf fix: better detect user identity in SAML responses
- 80a572fa chore: normalise font styles
- 82eba18b chore: update frontend dependencies
- 12a1d4d5 feat: make sidebar collapsible on mobile
- e108fb1c feat: support commands for getting kernel args and join configs in CLI
- 45a9d8c2 chore: types for route.meta.sidebar & title
- 110d551c chore: tailwind v4 upgrade
- 13d83648 chore: prepare omni for talos v1.11.0-beta.2
- 270eabf1 chore: commit vscode settings for frontend
- f264f1d1 fix: incorrect disabled icon color
- a268b8fd test: fix asserting etcd members test
- 69c4fd5d fix: prevent service account creation if name is already in use
- fe5d0280 feat: warn user about join token being in use during revoke/delete
- 73e42222 chore: more lint & formatting rules for omni/frontend
- 7e032266 chore: ts, lint, and formatting rules for omni frontend
- 928b7d89 test: fix omni upgrade e2e test
- 8e4f86f9 feat: rework breadcrumbs for clusters page
- 9521b302 chore: switch from bun to node
- 229e0060 fix: keep control plane status up to date
- 3f35ef23 chore: remove unused .eslintrc.yaml config
- 025c37f2 fix: stop enforcing talos version check on machine allocation
- c3b4f021 chore: rekres, bump talos and k8s versions
- 7e59f1ce fix: install frontend dependencies from lockfile
- 746c9662 chore: rekres to use correct slack channel for slack-notify
- 5047a625 feat: compute unique token status for each node
- e740c8b7 test: fix registry mirror config format in integration tests
- 0591d2ee feat: implement join token management CLI
- 4b0c32aa fix: remove MachineLabels when a Link is removed
- 9ac5cf4f fix: properly handle empty configs in omnictl config merge CLI command
- 0fc13bbf test: run Omni upgrade tests against latest stable
- 88f51163 chore: run inspector in the dev docker-compose
Changes since v1.1.0-beta.0
6 commits
- 904ff163 release(v1.1.0): prepare release
- e92c3415 feat: home page redesign
- 587ac1bc fix: add missing c

Omni 1.0.1 (2025-08-12)
Welcome to the v1.0.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Oguz Kilcan
Changes
9 commits
- e0605b9d release(v1.0.1): prepare release
- 353f0cab test: fix asserting etcd members test
- f42a94a6 fix: prevent service account creation if name is already in use
- f8ad61f0 test: fix omni upgrade e2e test
- 562bd58d test: run Omni upgrade tests against latest stable
- 092a0462 chore: allow more than one commit for a PR
- a221ba61 fix: keep control plane status up to date
- c6c8da2b fix: install frontend dependencies from lockfile
- 898f83d3 test: fix registry mirror config format in integration tests
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.0.0

Omni 1.0.0 (2025-07-25)
Welcome to the v1.0.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Multiple Join Token Support
Omni now supports multiple SideroLink join tokens.
It now creates the default non-expiring token, then the user can create more tokens and delete the old ones.
Config Change History
There is now MachineConfigDiffs.omni.sidero.dev resource that keeps the history of
each machine config change.
It keeps up to 1000 diffs for the last 30 days.
Contributors
- Artem Chernyshev
- Andrey Smirnov
- Utku Ozdemir
- Oguz Kilcan
- Mateusz Urbanek
Changes
23 commits
- 8bf87c12 release(v1.0.0): prepare release
- 781a04e1 chore: extract node unique token to the separate resource
- de7d90b7 test: allow ignoring unknown config fields in the integration test
- c761e347 release(v1.0.0-beta.1): prepare release
- 28158ed8 fix: ignore MachineStatus having no TalosVersion in DNS service
- da3f28f6 chore: support encoding extra docs in siderolink.RenderJoinConfig
- f4582116 fix: allow encoding join tokens using v1 version
- 80ff037a fix: do not try to encode v1/v2 tokens in siderolink.NewJoinToken
- 7b7c021d fix: do not create JoinTokenUsage for PendingMachines
- 2c4f34a7 fix: fix etcd status check in control plane status
- b0f76343 feat: implement the API for reading resources and their dependency graph
- e945cc7b release(v1.0.0-beta.0): prepare release
- a2722856 chore: enable gRPC keepalive in the Omni client
- f8de9a6d feat: add support for imported cluster secrets
- 753259c2 fix: do not filter out noop events in the infra provider state
- ab1f7cc7 feat: implement multiple token support and token management
- 0e76483b chore: rekres, bump deps, Go, Talos and k8s versions, satisfy linters
- e1c1aaea fix: add validation of k8s version
- f1b47f08 feat: log and store redacted machine config diffs
- a7ac6372 chore: rewrite join config generation
- 66c7897b chore: update zstd module go.mod deps
- 3b701483 test: reduce the log verbosity in unit tests
- ff32ae4c fix: gracefully handle logServer shutdown
Changes since v1.0.0-beta.1
3 commits
- 8bf87c12 release(v1.0.0): prepare release
- 781a04e1 chore: extract node unique token to the separate resource
- de7d90b7 test: allow ignoring unknown config fields in the integration test
Changes from siderolabs/crypto
5 commits
- 62a079b fix: update TLS config, add tests for TLS interactions
- c2b4e26 fix: remove code duplication and fix Ed255119 CA generation
- 2a07632 fix: enforce FIPS-140-3 compliance
- 17107ae fix: add generic CSR generator and OpenSSL interop
- 53659fc refactor: split into files
Dependency Changes
- github.com/cosi-project/runtime v0.10.5 -> v0.10.6
- github.com/siderolabs/crypto v0.5.1 -> v0.6.3
- github.com/siderolabs/talos/pkg/machinery v1.10.1 -> da5a4449f1a9
- google.golang.org/grpc v1.72.0 -> v1.73.0
Previous release can be found at v0.52.0

Omni 0.52.0 (2025-07-08)
Welcome to the v0.52.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Support Fusion Auth
Fusion Auth provider is now supported via SAML.
Additional parameter --auth-saml-name-id-format must be set to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
Infra Providers Request ID
Infra providers can now be configured to encode MachineRequest ID into the join token.
With that enabled setting the machine UUID in the MachineRequestStatus is no longer required in the provider:
Omni will automatically map the MachineRequest ID to the node UUID and will populate the field in the status.
This change is useful in the infra providers where it's impossible to get the created machine UUID.
Allow talosctl wipe disk Command
talosctl wipe disk can now be used with Omni managed nodes.
Omni will impersonate os:admin role for it if the user has write access to the cluster.
Contributors
- Artem Chernyshev
- Utku Ozdemir
- Orzelius
Changes
15 commits
- 1266560 release(v0.52.0): prepare release
- 438551c release(v0.52.0-beta.0): prepare release
- e1d4749 feat: allow talosctl wipe disk command
- 877b379 fix: update SAML library to the forked version with the ACS parser fix
- b1225c9 feat: support setting custom name ID format in SAML metadata
- c60820f fix: correctly detect installation status for bare-metal machines
- 344d061 feat: allow encoding the machine request ID into the join tokens
- a7fe525 test: test updating from old Omni version to the current
- abfe93c docs: add guide for development on darwin
- 0ad0a67 test: save a support bundle when a test suite has failed
- 9e4f819 fix: make sure clipped req/resp content logs are still valid JSONs
- 1c30730 feat: show the actual node name in the node overview breadcrumbs
- c097b5f fix: do not try running debug server in the prod builds
- 8a93c2d refactor: bring back the reverted new workload proxy dialing logic
- 122b796 test: run Omni as part of integration tests
Changes since v0.52.0-beta.0
1 commit
- 1266560 release(v0.52.0): prepare release
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.51.0

Omni 0.51.0 (2025-06-18)
Welcome to the v0.51.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Omni can now be configured using YAML configuration file in addition to the command line flags.
The parameter --config-file can be used for that. Any command line flags have higher priority.
Contributors
- Utku Ozdemir
- Artem Chernyshev
- Andrew Rynhard
- Andrey Smirnov
Changes
25 commits
- 34c61b7 release(v0.51.0): prepare release
- a36d357 release(v0.51.0-beta.2): prepare release
- 493d00c fix: properly support --config-path argument
- 742faec fix: do not mark SAML and Auth0 config sections as mutually exclusive
- de86c74 release(v0.51.0-beta.1): prepare release
- 4b40dc1 fix: do more fixes on config backward-compatibility
- 3085c3f fix: remove required config validation from k8s proxy cert and key
- bf6c38a release(v0.51.0-beta.0): prepare release
- 7a815ba fix: prevent zero machine count reports on controller shutdown
- 33e796e chore: rekres, bump Go to 1.24.4, SideroLink to v0.3.15
- f3cec18 fix: fix exposed service prefix conflict resolution
- 5e4c10b fix: use 0.0.0.0:8095 as the default bind endpoint for Kubernetes
- ccd55cc feat: rewrite Omni config management
- 05aad4d fix: check config patch creation time as well as updated on orphan check
- f3783ed fix: display unknown power state correctly on the machines screen
- 7c19c31 test: improve workload proxying tests
- c9c4c8e test: use go test to build and run Omni integration tests
- df5a2b9 fix: bump inmem COSI state history capacity
- aa5d89d fix: fix panic in maintenance upgrade
- 404bbd9 chore: allow running Omni programmatically from other Go code
- 9846622 fix: fix nil dereference in machine status controller
- 13bb8b5 docs: update SECURITY.md
- 178d2ad fix: make sure powering on stage is correctly set on infra machines
- e5d1b4b fix: properly detect infra provider service accounts
- d88bb1d test: use latest Talemu infra provider version in the integration tests
Changes since v0.51.0-beta.2
1 commit
- 34c61b7 release(v0.51.0): prepare release
Changes from siderolabs/gen
3 commits
- dcb2b74 feat: add panicsafe package
- b36ee43 feat: make xyaml.CheckUnknownKeys public
- 3e319e7 feat: implement xyaml.UnmarshalStrict
Changes from siderolabs/siderolink
2 commits
- 5f46f65 feat: handle panics in goroutines
- d09ff45 fix: race in wait value
Dependency Changes
- github.com/go-logr/logr v1.4.2 new
- github.com/go-playground/validator/v10 v10.26.0 new
- github.com/siderolabs/gen v0.8.1 -> v0.8.4
- github.com/siderolabs/siderolink v0.3.14 -> v0.3.15
- golang.org/x/crypto v0.38.0 -> v0.39.0
- golang.org/x/net v0.40.0 -> v0.41.0
- golang.org/x/sync v0.14.0 -> v0.15.0
- golang.org/x/text v0.25.0 -> v0.26.0
Previous release can be found at v0.50.0

Omni 0.50.1 (2025-05-27)
Welcome to the v0.50.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
3 commits
- ca335cc release(v0.50.1): prepare release
- 1719ae3 test: use latest Talemu infra provider version in the integration tests
- 4d8f73a fix: properly detect infra provider service accounts
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.50.0

Omni 0.50.0 (2025-05-23)
Welcome to the v0.50.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Infra Providers
Omni now has the UI for viewing and managing infra providers.
Additionally, the service accounts with the role InfraProvider are no longer displayed
in the UI and not returned in the omnictl serviceaccounts list CLI command.
Infra providers now got their own set of CLI commands under omnictl infraprovider.
Talos 1.10 Support
Omni now supports Talos 1.10.
Contributors
- Artem Chernyshev
- Noel Georgi
- Utku Ozdemir
- Andrey Smirnov
- Aleksandr Gamzin
- Dmitriy Matrenichev
- kalio007
Changes
16 commits
- e8b17cd release(v0.50.0): prepare release
- 7c17ed6 fix: use the correct schematic IP for maintenance upgrades
- 0020ee3 feat: allow managing infra providers in the UI
- 74a9ad3 fix: make cluster validations consistent between templates and UI
- 4792641 fix: do not show some menu elements for Reader users in the UI
- ca66bb8 release(v0.50.0-beta.0): prepare release
- 09f4468 fix: pin AWS s3 libs version to 1.72.3
- dc753f4 test: bump Talos version used in integration tests to v1.10
- f21cedc chore: introduce COSI state helpers to reduce boiler plate code count
- 9fcea4e test: add unit test for nextAvailableClusterName function
- c9b62c2 fix: update go-kubernetes library to the latest version
- daaec8d fix: remove deprecated controller finalizers from the machine classes
- eaeff1e fix: keep ClusterUUID resource alive until the cluster is destroyed
- aa24c7c fix: fix crash in the SAML ACS handler
- ccd5e7e chore: bump Go deps
- 47b6fb7 feat(ci): support releasing helm charts
Changes since v0.50.0-beta.0
5 commits
- e8b17cd release(v0.50.0): prepare release
- 7c17ed6 fix: use the correct schematic IP for maintenance upgrades
- 0020ee3 feat: allow managing infra providers in the UI
- 74a9ad3 fix: make cluster validations consistent between templates and UI
- 4792641 fix: do not show some menu elements for Reader users in the UI
Changes from siderolabs/gen
1 commit
- 7c0324f chore: future-proof HashTrieMap
Changes from siderolabs/go-circular
1 commit
- 5b39ef8 fix: do not log error if chunk zero was never written
Changes from siderolabs/go-kubernetes
2 commits
- 9070be4 fix: remove DynamicResourceAllocation feature gate
- 8cb588b fix: k8s 1.32->1.33 upgrade check
Changes from siderolabs/image-factory
8 commits
- f930246 release(v0.7.0): prepare release
- 5b85f95 chore: bump deps
- cdfab7d chore(ci): add an cron ci for talos main integration test
- 69525ba release(v0.6.9): prepare release
- 2820cb0 feat(i18n): frontend localization support
- f1187bc chore: bump deps
- ba8640b chore: bump deps
- b8308aa chore: bump talos machinery
Changes from siderolabs/siderolink
1 commit
- d2a79e0 fix: clean up device on failure
Dependency Changes
- github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.72 -> v1.17.49
- github.com/aws/aws-sdk-go-v2/service/s3 v1.79.2 -> v1.72.3
- github.com/cosi-project/runtime v0.10.2 -> v0.10.5
- github.com/cosi-project/state-etcd v0.5.1 -> v0.5.2
- github.com/siderolabs/gen v0.8.0 -> v0.8.1
- github.com/siderolabs/go-circular v0.2.2 -> v0.2.3
- github.com/siderolabs/go-kubernetes v0.2.21 -> v0.2.23
- github.com/siderolabs/image-factory v0.6.8 -> v0.7.0
- github.com/siderolabs/omni/client v0.48.3 -> v0.49.0
- github.com/siderolabs/siderolink v0.3.13 -> v0.3.14
- github.com/siderolabs/talos/pkg/machinery v1.10.0 -> v1.10.1
- github.com/zitadel/oidc/v3 v3.37.0 -> v3.38.1
- golang.org/x/crypto v0.37.0 -> v0.38.0
- golang.org/x/net v0.39.0 -> v0.40.0
- golang.org/x/sync v0.13.0 -> v0.14.0
- golang.org/x/text v0.24.0 -> v0.25.0
- golang.org/x/tools v0.32.0 -> v0.33.0
- golang.zx2c4.com/wireguard 12269c276173 -> 436f7fdc1670
Previous release can be found at v0.49.0

Omni 0.49.1 (2025-05-07)
Welcome to the v0.49.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
2 commits
- 32edf99 release(v0.49.1): prepare release
- e952f99 fix: fix crash in the SAML ACS handler
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.49.0

Omni 0.49.0 (2025-05-07)
Welcome to the v0.49.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Async Discovery Service Cleanup
The machine teardown now no longer blocks on the discovery service being unavailable.
If failed, discovery service removal is now handled async.
Control Plane Force Delete
Omni now allows forcefully removing the control plane nodes from the cluster, where etcd is not healthy.
Contributors
- David Anderson
- Artem Chernyshev
- Utku Ozdemir
- Brad Fitzpatrick
- Noel Georgi
- Andrey Smirnov
- AdamEr8
- Andrey Smirnov
- Andrey Smirnov
- Dominic Evans
- Khionu Sybiern
- Nathan Johnson
- Ryan Cox
- Vincent Batts
- ignoramous
Changes
34 commits
- cd46283 release(v0.49.0): prepare release
- 5f55c05 fix: use the correct res order for the cluster operations in the UI
- 029ec05 test: bump Talemu tests timeout
- c9f9947 release(v0.49.0-beta.0): prepare release
- 68292cc chore: update JS deps, drop package-lock.json
- d3bbc2f fix: gracefully render exposed services errors
- c329668 fix: correctly encode exposed service redirect URL after auth
- 7acf2d9 feat: update machinery and specs to Talos 1.10.0
- ccf4bfb fix: use the correct sort order for the automatic install disk selection
- 34c96f2 fix: collect and handle UKI boot information
- ff03233 fix: remove machine set allocation source option
- e7ece82 fix: disable Talos >= 1.10 for now as Omni isn't ready for it yet
- 2606693 fix: remove "Generated by Omni..." comment from machine config
- 574a0b0 fix: sort Talos versions by semver on the cluster creation screen
- fbb80f0 feat: implement async delete from discovery service(s)
- 1722b4b fix: loosen s3 integrity check for etcd backups
- 1dce4ac feat: allow force-destroying a node in booting state
- 3897080 test: add config encoding stability tests
- 0fc7a16 test: fix the flaky key storage test
- 71cef7a fix: do not add omni api host to kube-apiserver cert SANs
- 5057ba9 chore: rekres, bump deps, satisfy linters, fix generated test headers
- 9a81546 fix: return proper errors for the SideroLink provision API
- 970dafc fix: correctly sort versions on the download installation media page
- e407b0a fix: move JSON schema forms validation to backend
- d96b2bc feat: improve logging/debugging of exposed services
- 21213d8 fix: properly skip the contract config patch removal migration
- 09a7d48 fix: add annotations on the ClusterMachines to force enable features
- 282fba4 fix: use correct version contract for machine config generation
- 3f3f8a9 fix: create config patches to prevent reboot on version contract revert
- 17129e5 fix: config patch cleanup
- d9b5dae fix: fix existing alias check for exposed services
- 09c80dd fix: mark all exposed services to have a non-explicit alias
- 3e07a88 fix: revert workload proxy LB refactoring
- b32f555 fix: use proper background for the sticky window in the code editor
Changes since v0.49.0-beta.0
3 commits
- cd46283 release(v0.49.0): prepare release
- 5f55c05 fix: use the correct res order for the cluster operations in the UI
- 029ec05 test: bump Talemu tests timeout
Changes from siderolabs/go-kubernetes
1 commit
- 2bdbda7 feat: adjust checks for Kubernetes v1.33.0
Changes from siderolabs/image-factory
6 commits
- 3e56929 release(v0.6.8): prepare release
- 1af002d feat: support platform specific installers
- e1d19df chore: add more tests for talos 1.10
- 0ecde68 fix(ci): image push
- 2460d03 fix(ci): image push
- a016223 feat: pull in new Talos machinery
Changes from siderolabs/tcpproxy
70 commits
- 3d4e7b8 chore: rename to siderolabs/tcpproxy
- 6f85d8e Implement correct half-close sequence for the connections.
- 8bea9a4 Add support for TCP_USER_TIMEOUT setting
- 91f8614 remove old ACME tls-sni-01 stuff that LetsEncrypt removed March 2019
- 74ca1dc add Proxy.AddSNIRouteFunc to do lookups by SNI dynamically
- 4e04b92 gofmt for Go 1.19
- be3ee21 (doc): s/tlsproxy/tcpproxy
- 2e577fe Modified TestProxyPROXYOut to conf

Omni 0.48.4 (2025-04-29)
Welcome to the v0.48.4 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
2 commits
- 888cca9 release(v0.48.4): prepare release
- 7407d7a fix: disable Talos >= 1.10 for now as Omni isn't ready for it yet
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.48.3

Omni 0.48.3 (2025-04-16)
Welcome to the v0.48.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
Changes
3 commits
- f1acdbd release(v0.48.3): prepare release
- 7e57fb8 fix: properly skip the contract config patch removal migration
- 4e00895 fix: add annotations on the ClusterMachines to force enable features
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.48.2

Omni 0.48.1 (2025-04-11)
Welcome to the v0.48.1 release of Omni!
This is a pre-release of Omni
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- David Anderson
- Brad Fitzpatrick
- Utku Ozdemir
- AdamEr8
- Andrey Smirnov
- Artem Chernyshev
- Andrey Smirnov
- Dominic Evans
- Khionu Sybiern
- Nathan Johnson
- Ryan Cox
- Vincent Batts
- ignoramous
Changes
5 commits
- ce82fb3 release(v0.48.1): prepare release
- 09ea168 fix: fix existing alias check for exposed services
- 0a760c1 fix: mark all exposed services to have a non-explicit alias
- 0b6318a fix: revert workload proxy LB refactoring
- f417d12 fix: use proper background for the sticky window in the code editor
Changes from siderolabs/tcpproxy
70 commits
- 3d4e7b8 chore: rename to siderolabs/tcpproxy
- 6f85d8e Implement correct half-close sequence for the connections.
- 8bea9a4 Add support for TCP_USER_TIMEOUT setting
- 91f8614 remove old ACME tls-sni-01 stuff that LetsEncrypt removed March 2019
- 74ca1dc add Proxy.AddSNIRouteFunc to do lookups by SNI dynamically
- 4e04b92 gofmt for Go 1.19
- be3ee21 (doc): s/tlsproxy/tcpproxy
- 2e577fe Modified TestProxyPROXYOut to conform with the fixed version of PROXY protocol header format
- 0f9bced Fixed HAProxy's PROXY protocol v1 Human-readable header format in DialProxy
- 2825d76 fix(test): update travis and e2e selfSignedCert fn
- b6bb9b5 Update import path to inet.af/tcpproxy
- dfa16c6 tlsrouter/README: fix the go get url
- f5c09fb Take advantage of Go 1.11's splice support, unwrap Conns in DialProxy.HandleConn
- 7f81f77 Work around deadlock with Go tip (at Go rev f3f7bd5)
- 7efa37f Quiet log spam in test.
- dbc1514 Adding the HostName field to the Conn struct (#18)
- 2b928d9 Link to docs
- de1c7de Add support for arbitrary matching against HTTP and SNI hostnames.
- c6a0996 Support configurable routing of ACME tls-sni-01 challenges.
- 815c942 Merge matcher and route into an interface that yields a Target.
- 2065af4 Support HAProxy's PROXY protocol v1 in DialProxy.
- e030359 Fix golint nits by adding docstrings and simplifying execution flow.
- 6d97c2a Correct the package building command, and only deploy for master branch commits.
- aa12504 Another attempt to fix Travis.
- f6af481 Make Travis test all packages, and remove the go.universe.tf import path.
- d7e343e Fix the godoc link to point to google/tcpproxy.
- bef9f6a Merge bradfitz's tcpproxy codebase with the software formerly known as tlsrouter.
- d86e96a Move tlsrouter's readme to the command's directory.
- 9e73877 Switch license to Apache2, add Google copyright headers.
- cbf137d Correct the travis build to kinda work.
- 3eb49e9 Move tlsrouter to cmd/tlsrouter, in preparation for rewrite as a pkg.
- af97cdd Fix copy/paste-o in doc example.
- 3273f40 Add vendor warning
- e387889 Add TargetListener
- 2eb0155 Start of tcpproxy. No Listener or reverse dialing yet.
- c58b44c Make golint fail if lint errors are found, and fix said lint.
- 4621df9 Clean up the Travis build a bit more, moving more stuff to the deploy stage.
- 96cc76f Test Travis's new build stage support.
- bbbede8 Make travis fetch the test-only dependency.
- 4b8641f Add support for HAProxy's PROXY protocol.
- d23eadc Upload packages based on Go 1.8, not 1.7.
- 7ef32e3 Add Go 1.8 to the build matrix.
- e07ecec typo
- aa3f9c9 Remove debug print in acme code.
- 6664640 Stop testing against Go 1.6.
- 728b8bc Add ACME routing support.
- a5c2ccd Use nogroup as the group, not nobody.
- a94dbd1 Port extra error checking over from netboot.
- 3cd4412 Clean up travis config a bit, and add missing copyright notice.
- aded796 Add a deploy step to garbage-collect old packagecloud files.
- 3e6354c Random change to force travis rebuild on latest code.
- 77fa998 Attempt to create a package with no version name.
- bfef4ba Revert to just debian/jessie. It's the same package anyway.
- 173db90 Try the obvious way to specify a matrix of package tags.
- ea58780 Limit th

Omni 0.48.0 (2025-04-08)
Welcome to the v0.48.0 release of Omni!
This is a pre-release of Omni
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Custom Etcd Backup Throughput
The throughput for etcd backup uploads/downloads can now be limited using the --etcd-backup-upload-limit-mbps and --etcd-backup-download-limit-mbps flags.
Explicit Exposed Service Prefixes
Users can now explicitly specify the prefix for exposed services using the omni-kube-service-exposer.sidero.dev/prefix annotation on their Kubernetes Services.
This is useful when users prefer not to have prefixes randomly generated.
Filter Clusters by Readiness
Clusters can now be filtered by readiness status in the Omni UI.
Cleanup of Unused Config Patches
User-managed config patches not associated with an existing target (e.g., cluster, machine set, or machine) are now cleaned up after 30 days.
Contributors
- Artem Chernyshev
- Utku Ozdemir
- Dmitriy Matrenichev
- Andrey Smirnov
- Orzelius
- Luke Milby
- Matt Willsher
- Nick Niehoff
- Noel Georgi
Changes
55 commits
- a78bad1 release(v0.48.0): prepare release
- 9b811b3 chore: change upload and download limits flags to mbps
- 6e4b386 release(v0.48.0-beta.0): prepare release
- 5c4e983 fix: restore timeout in OmniSuite.SetupTest
- 72405c7 fix: filter out device mapper/lvm disks from block devices
- a91bb04 feat: use <platform>-installer[-secureboot] as the installer image
- 77ab722 chore: rekres, bump Go, regenerate, fix docker-compose targets
- 9338a1a fix: check proper jittered time in unit tests
- 6978d31 chore: add support for jitter in EtcdBackupController
- 143e7a6 feat: support filtering clusters by readiness
- d93ae59 fix: ignore 404 errors when removing disconnected links of a cluster
- 9abf37c fix: use clearer description on the machines page metrics
- 2a20840 fix: correctly parse commas in label selectors
- 764cec4 fix: show warning instead of error for etcd quorum being at min
- 4f00856 chore: update dependencies
- b6563c2 chore: bump default Talos version to 1.9.5, Kubernetes version to 1.32.3
- 5ef843f fix: properly display error message when machine class removal failed
- b91b673 fix: add more strict security headers to the web page handler
- 57c005e feat: allow setting exposed service prefixes explicitly
- 3c55a0b fix: do not allow http[s] urls in the redirect query
- 0cd8212 fix: do not select USB sticks by default
- 3650c60 fix: duplicate resources declaration in helm deployment
- 7c50e8b fix: update text and description for SideroLink over GRPC
- 4dea372 chore: add GOEXPERIMENT env to vscode config
- e6e9202 test: fix the timing related flake in resource logger test
- 3b0e831 fix: do not switch Siderolink GRPC tunnel mode after provisioning
- 4a8546e fix: some updated icons were appearing as white
- 1fb14d2 fix: do not clip the tooltip in the cluster machine status
- 63a3c52 chore: update all used icons
- 1e721e5 feat: cleanup orphan config patches
- f7da5d0 chore: rework EtcdBackupControllerSuite to use synctest experiment
- a5efd81 feat: validate incoming packets addresses in siderolink manager
- 966b99c chore: rekres to enable separate cache
- b1c71f0 feat: add support for custom throughput for uploads and downloads
- 86976d3 perf: move etcd backup status resources into secondary storage
- 1e67803 fix: remove force unique token annotation from the link on wipe
- 9012978 chore: replace InfoIterator with iter.Seq2 type
- b519c6c chore: migrate ConfigPatches above threshold of 2048
- b264a41 fix: properly support the PXE and ISO machines in the secure tokens flow
- fd2d340 fix: exclude metal-agent extension from available extensions
- c6e5a5f chore: enable compression only for ConfigPatch
- bd264cd chore: expose omni_runtime_cached_resources metric
- e751022 chore: rework Reconciler to use proper http.Transport
- 2bb38e3 chore: add omni_machine_config_patch_size metrics
- 075698d fix: preserve SideroLink tunnel config on machine allocation
- 56fbf31

Omni 0.47.1 (2025-02-28)
Welcome to the v0.47.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Artem Chernyshev
- Dmitriy Matrenichev
- Utku Ozdemir
- Orzelius
Changes
8 commits
- 4a9a81f release(v0.47.1): prepare release
- fb23d12 fix: skip applying maintenance config to unsupported machines
- b2edd82 fix: disable compressConfigsAndMachinePatches
- 95b5372 fix: fix exposed service links on the sidebar
- e1401fa fix: properly build the search query on the Machines page
- d6eb100 chore: add logging for migrations
- c44a815 fix: extensions list hidden on small screens
- 06d5c53 fix: properly read the siderolink-disable-last-endpoint flag
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.47.0

Omni 0.47.0 (2025-02-24)
Welcome to the v0.47.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Manual BMC Configs
BMC configs now can be set manually in the bare-metal infra provider.
Machine Categories
Machine categories were now moved to the sidebar, which gives a way to filter them by each particular provider.
Maintenance Configs
Omni now injects KmsgLog and EventSink configs for each joined node.
So the node will work even if only the siderolink config pushed to it.
Service Accounts UI
Service accounts creation UI now presents the environment variables (endpoint and key) instead of the key only.
Contributors
- Artem Chernyshev
- Dmitriy Matrenichev
- Utku Ozdemir
- Andrey Smirnov
- Andrew Rynhard
- Ethan Norlander
Changes
30 commits
- ddc977e release(v0.47.0): prepare release
- fcf04aa fix: fix bug with Omni adding machine to a cluster before upgrading
- 9e68edd release(v0.47.0-beta.1): prepare release
- d25146a fix: fix config compression migration
- fbe0582 release(v0.47.0-beta.0): prepare release
- f7b2cdf test: improve e2e upgrades and e2e templates tests stability
- 6a807c1 feat: push a partial config to machines in maintenance mode
- 1d291c4 fix: adjust the UI layout and get rid of a couple of bugs
- 5fe3223 feat: add a flag to enable secure join token flow
- c662c2e feat: implement the machine categories UI for the sidebar
- 2cb37d8 chore: add compressConfigsAndMachinePatches migration back
- 2108697 docs: how to download generic talosconfig in omnictl talosconfig help
- 7e32dcc fix: detect more block devices
- 2e9828a fix: properly handle duplicate UUID
- ff107e5 fix: add workaround to stage upgrades for talos v1.9.0-v1.9.2
- 9bb85f8 feat: implement secure node join flow
- 0cda77b chore: bump Go and rekres
- 0f7563f fix: make the apply config fail if machine has wrong state
- 6fb1fcd feat: allow manual bmc configuration for bare metal machines
- b654b2c chore: remove unused field in s3store.Store
- 2dc4dae chore: omni enable config compression by default
- 214eece chore: bump deps
- 651d98e fix: enable IDP initiated SAML logins
- 951c0de fix: don't forget to close grpc connections in tests
- 157ceac fix: close grpc connections after their usage is complete
- 6f014b1 fix: fix node resolution cache for nodes in maintenance mode
- 65244f6 test: run the integration tests only for pull requests
- ed946b3 feat: display OMNI_ENDPOINT in the service account creation UI
- 7ae5af7 fix: do not compress resources with phase != running
- 4485296 feat: add Stripe machine reporting
Changes since v0.47.0-beta.1
2 commits
- ddc977e release(v0.47.0): prepare release
- fcf04aa fix: fix bug with Omni adding machine to a cluster before upgrading
Changes from siderolabs/go-circular
2 commits
- 015a398 fix: replace static buffer allocation on growth
- ed8685e test: add more assertions for write length result
Changes from siderolabs/go-debug
1 commit
- ea108ca chore: add support for Go 1.24
Changes from siderolabs/proto-codec
1 commit
- 3235c29 chore: bump deps
Changes from siderolabs/siderolink
1 commit
- 38e459e chore: bump deps
Dependency Changes
- github.com/cenkalti/backoff/v4 v4.3.0 new
- github.com/cosi-project/runtime v0.9.2 -> v0.9.4
- github.com/cosi-project/state-etcd v0.5.0 -> v0.5.1
- github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 -> v2.26.0
- github.com/prometheus/common v0.61.0 -> v0.62.0
- github.com/siderolabs/go-circular v0.2.1 -> v0.2.2
- github.com/siderolabs/go-debug v0.4.0 -> v0.5.0
- github.com/siderolabs/proto-codec v0.1.1 -> v0.1.2
- github.com/siderolabs/siderolink v0.3.11 -> v0.3.12
- github.com/stripe/stripe-go/v74 v74.30.0 new
- go.etcd.io/etcd/client/pkg/v3 v3.5.17 -> v3.5.18
- go.etcd.io/etcd/client/v3 v3.5.17 -> v3.5.18
- go.etcd.io/etcd/server/v3 v3.5.17 -> v3.5.18
- golang.org/x/crypto v0.32.0 -> v0.33.0
- golang.org/x/net v0.34.0 -> v0.35.0
- golang.org/x/sync v0.10.0 -> v0.11.0
- google.golang.org/grpc v1.69.4 -> v1.70.0
- goog

Omni 0.46.3 (2025-02-06)
Welcome to the v0.46.3 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Dmitriy Matrenichev
Changes
2 commits
- 05dc0ca release(0.46.3): prepare release
- 3aca8a0 chore: omni enable config compression by default
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.46.2

Omni 0.46.2 (2025-02-05)
Welcome to the v0.46.2 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Dmitriy Matrenichev
- Utku Ozdemir
- Artem Chernyshev
Changes
5 commits
- 43dbd98 release(v0.46.2): prepare release
- ffd8929 fix: enable IDP initiated SAML logins
- 1710ea0 fix: don't forget to close grpc connections in tests
- b6af6c7 fix: close grpc connections after their usage is complete
- 26ba403 fix: fix node resolution cache for nodes in maintenance mode
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.46.1

Omni 0.46.1 (2025-01-29)
Welcome to the v0.46.1 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Contributors
- Dmitriy Matrenichev
Changes
2 commits
- 5ec809f release(v0.46.1): prepare release
- c5b5203 fix: do not compress resources with phase != running
Dependency Changes
This release has no dependency changes
Previous release can be found at v0.46.0

Omni 0.46.0 (2025-01-28)
Welcome to the v0.46.0 release of Omni!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.
Bare Metal Infra Provider Support
Omni now supports bare metal infra provider.
This provider operates as a standalone service that can be deployed within a bare-metal datacenter network.
It manages machines via IPMI, supports PXE-based booting, and enables machine resets without relying on the Talos API.
Its functionality closely resembles that of Sidero Metal.
For detailed setup instructions, refer to the documentation..
Machine Categories
The Machines page now categorizes machines based on how they were added to the account:
- Manual: Machines manually added by installing Talos with siderolink parameters.
- Provisioned: Machines created by infrastructure providers (e.g., KubeVirt).
- PXE-Booted: Machines discovered and accepted from the bare-metal infrastructure provider.
- Pending: Machines discovered but not yet accepted from the bare-metal infrastructure provider.
Contributors
- Utku Ozdemir
- Artem Chernyshev
- Andrey Smirnov
- Dmitriy Matrenichev
- Noel Georgi
- Joakim Nohlgård
- Nico Berlee
Changes
35 commits
- 75982e4 release(v0.46.0): prepare release
- e2e5f08 chore: migrate uncompressed resources data
- fd888ab refactor: track infra machine install status via a counter
- c6b7dd3 test: extract static infra provider machine accept tests into hooks
- 8db0e8d test: fix readyToUse flag assertions in static infra provider tests
- 4a436b4 fix: correctly handle conflict error in machine status handler
- 6e910e1 fix: update COSI runtime to fix watch retry errors
- 2fcfc82 release(v0.46.0-beta.0): prepare release
- afc9dcf feat: introduce resource for infra provider health checks
- 096f14f feat: calculate not accepted machines count in the machine status ctrl
- 1495ca0 feat: implement power states as machine stage events
- 2a2c648 feat: bump default Talos version to 1.9.1, Kubernetes to 1.32.0
- 5db4c8c feat: add disk wipe warning when accepting a pending machine
- 9208587 chore: bump Go, dependencies, rekres, regenerate
- 84c01fd fix: properly reset MachineStatus hostname for deallocated machines
- d5e1f85 fix: do not allow using static infra providers in the machine classes
- d1b3dff fix: fix immutability checks in infra provider state
- 353a3c0 fix: change the look of the infra provider labels
- 7052e8b fix: enable secure boot checkbox in the UI
- 394065f feat: implement cordoning infra machines
- 728897a fix: wait for infra machine info to be collected before powering off
- 1c4f9af feat: implement infra machine reboot
- edc47a0 feat: sync infra machine labels onto the machine status
- 6f10a97 fix: fallback to machine ID correctly if its hostname is missing
- 3ba096a fix: bring in new versions of COSI runtime and state-etcd
- 82da2f4 fix: never remove etcd members which ID is discovered at least once
- 3dd7e93 fix: display nodes sidebar
- 06aa266 fix: etcd lease handlining
- 34dd2ae feat: properly handle powered off machines in the UI and machine classes
- 1d8c754 fix: do not preserve extensions on Talos agent mode
- 1f81400 fix: run destroy validations on teardown
- 6190568 fix: allow accepting rejected infra machines
- 3332684 fix: correctly handle input finalizers in InfraMachineController
- b7c3c50 feat: add support for Zitadel IdP
- e8aee8e feat: implement the machine categories UI
Changes since v0.46.0-beta.0
7 commits
- 75982e4 release(v0.46.0): prepare release
- e2e5f08 chore: migrate uncompressed resources data
- fd888ab refactor: track infra machine install status via a counter
- c6b7dd3 test: extract static infra provider machine accept tests into hooks
- 8db0e8d test: fix readyToUse flag assertions in static infra provider tests
- 4a436b4 fix: correctly handle conflict error in machine status handler
- 6e910e1 fix: update COSI runtime to fix watch retry errors
Changes from siderolabs/discovery-service
1 commit
- 7c1129e chore: bump deps
Changes