talos-upgrade

Files (1)

• SKILL.md

SKILL.md (first lines)

# Talos + Kubernetes upgrades

## Absolute rules

1. Walk **Talos minors** (no 1.11 → 1.13 direct)  
2. Walk **k8s minors** one at a time  
3. Talos version gates max k8s in catalogs (check live docs/Omni)  
4. Prefer Omni template sync if Omni manages machines; else talosctl carefully  
5. After k8s bumps, **diff bootstrap manifests** — do not replace Cilium  
6. With Omni: change `talos.version` / `kubernetes.version` in the cluster template and `sync`; Omni rolls node by node. Match `omnictl` to the server's API version first ("client API version mismatch" otherwise)  
7. Omni itself upgrades one minor at a time; cluster health takes a few minutes to return after each restart  

## Example path shape

```text
Talos patch → k8s patch on same minor
→ Talos next minor → k8s next minor
→ repeat
```

## Prerequisites

- [ ] Nodes Ready  
- [ ] etcd healthy / backup understood  
- [ ] Maintenance window  
- [ ] CNI is Cilium (or known)  

## Verify each phase

```bash
kubectl get nodes -o wide
kubectl get pods -A | grep -v Running | grep -v Completed || true
kubectl get --raw /healthz?verbose | head
```

## Do not

- Skip minors  
- Upgrade during storage/network incident  
- Blindly accept conflicting CNI manifests  
- Reboot a control plane as a health fix: find what it is waiting for first (`docs/platform/disk-and-etcd-health.md`)  
- Leave bare pods around: a drain deletes them  

## Notes from real upgrades

- A Talos minor and a Kubernetes minor took about 4–5 minutes each on a two-node lab cluster through Omni.
- GPU nodes need the extension set that matches the new Talos version; check the schematic before the upgrade, not after.
- Talos 1.14 moved kube-proxy and the default CNI into their own config documents; patches that disabled them the old way need a look.

From giovannirco/agentic-homelab, MIT.

More from giovannirco/agentic-homelab