Talos Linux v1.14.0 released on 03-09-2026
Talos Linux v1.14.0 is out now. It delivers encrypted DNS (DoT/DoH), native host BGP and a substantial set of storage and container runtime improvements aimed at operators who need tighter networking and predictable disk behaviour.
See the full release notes and download the binaries on the Talos GitHub release page for details and upgrade artifacts: github.com/siderolabs/talos/releases/tag/v1.14.0.
What’s in this release
- Encrypted DNS: DNS over TLS (DoT) and DNS over HTTPS (DoH) are supported and can be configured per name‑server via the ResolverConfig document.
- Native BGP: embedded GoBGP with repeatable, named BGPInstanceConfig documents (VRF support, numbered and unnumbered peering, ECMP, BFD, per‑neighbor hold/BFD settings and observable BGPPeerStatus resources).
- Block and filesystem updates: btrfs support, declarative LVM and MD RAID management (create/grow, status resources and talosctl wipe commands), XFS allocation‑group sizing control, periodic filesystem trim and XFS scrub support.
Upgrade notes
- Deprecations and operational changes: many v1alpha1 fields have moved to multi‑document kinds — follow the migration docs and replace deprecated fields with the new documents (for example, ResolverConfig, CRIBaseRuntimeSpecConfig, CRICustomizationConfig, EtcFileConfig and the various Kube*Config documents). etcd now exposes HTTP endpoints on port 2383 (metrics/health/gRPC-gateway) while gRPC remains on 2379 — update scrapers and firewall rules accordingly. The talosctl apply-config –mode=reboot option has been removed; configuration is applied without reboot by default and the docs list which changes still require one. The default installer image is now provided by Image Factory instead of the ghcr.io/siderolabs/installer image.
- Rollback / testing note: you can test upgrades without an automatic reboot using the new –no-reboot option on the upgrade command; when running native BGP be aware BFD is only supported by the instance in the default routing domain (BFD is not VRF‑aware), and set installRoutes: false on BGPInstanceConfig if you want learned routes kept out of the Linux routing table.
Let us know how v1.14.0 performs in your environment — share issues on the Talos GitHub and report any surprises or wins from upgrades and day‑to‑day use.
