From staged networking to cluster imports: What’s new in Q4 2025

Hannah Augur

January 29, 2026

7 min read

Talos Linux and Omni were purpose-built to solve the difficulty of bare metal. Our latest updates replace the high-stakes risk of physical deployments with cloud-like automated guardrails, enabling staged provisioning, seamless remote management, and stability rooted in automated governance rather than reactive troubleshooting. The result is infrastructure that is self-healing, immutable, and resistant to human error.

By moving to a multi-document model, we’ve introduced phased provisioning. This allows Talos Linux to establish secure networking and enter a manageable state using only a subset of configuration documents, so you have full remote visibility before the machine ever joins the production cluster. Businesses no longer have to choose between bare metal performance and cloud-like ease. Users get a fleet that is faster to deploy, harder to crash, and easier to secure, so senior engineers can focus on the work that creates value.

TL;DR

We made complex networking safer and easier to apply by breaking out common networking settings into their own configuration documents.
We made infrastructure consolidation faster to achieve with zero-downtime cluster imports into Omni.
We’ve made resource-constrained clusters safer through out-of-memory handling, automated SAML updates, OIDC authentication support, real-time kernel arg tuning, and more.

Read the full list of changes and documentation at GitHub or our documentation.

[Multi-doc network configs] Eliminate high-stakes network configuration failures for bare metal

Deploying bare-metal nodes has historically been a significant gamble where a single typo in a 200-line configuration file could brick a remote server, forcing a costly and time-consuming manual reset.

Talos Linux 1.12 eliminates this risk by introducing staged networking through multi-document configuration. Users can now establish a simple heartbeat connection, layering in VLANs and bonded interfaces only after connectivity is confirmed. This is powered by embedded machine configs, which move critical networking out of fragile, hard-to-audit kernel arguments and into a unified YAML format. Instead of wrestling with cryptic boot strings, teams can now implement advanced network requirements using standard manifests.

Engineers can ensure that even the most complex networking is applied predictably, reducing bring-up failures and simplifying recovery.

Leaders benefit from a declarative workflow that reduces expensive truck rolls and troubleshooting, increasing operational efficiency and reducing the risk of burnout. Leaders also gain a more auditable security posture as teams move away from convoluted kernel args.

Learn more about multi-doc configs below or read about multi-doc networking here. →

[OOM handling] Reduce unpredictable node failures caused by unmanaged memory pressure

Linux kernel cannot distinguish between apps and critical system services, a memory spike can easily lead to the seemingly random killing of the Kubernetes components required to keep the node online. This turns minor application bugs into infrastructure outages, leaving nodes unreachable and requiring manual reboots to restore service.

Talos Linux 1.12 replaces this volatility with proactive stability guardrails through a new userspace out-of-memory (OOM) handler, which enables Talos to identify and evict the specific, resource-heavy application before it can destabilize the host.

Engineers worry less about unpredictable system failures and can ensure that the control plane and critical services remain operational even during traffic surges or noisy neighbor events.

Leaders benefit from decreased avoidable downtime, as core Kubernetes components are able to keep running and protect critical system stability from unpredictable application behavior. This is particularly valuable in single-node edge environments, where a crashed server results in a total loss of site connectivity.

[Image cache] Seed container images to air-gapped clusters without a local registry

Provisioning air-gapped or edge clusters usually requires deploying a dedicated, permanent registry, adding significant hardware overhead and maintenance toil to a limited environment. This infrastructure requirement delays site bring-up and creates a bottleneck for testing and automation.

Talos Linux 1.12 streamlines this process by introducing a lightweight, read-only registry served directly through talosctl. Teams can now use an internet-connected machine to create an image cache and then use the new cache-serve command to provide those images over HTTP/HTTPS at the deployment site. This removes the need to stand up and manage a full registry infrastructure just to move images via USB or local network.

Engineers accelerate deployment velocity by seeding images directly to nodes, shortening the path from unboxing to “Ready” without the overhead of standing up a local registry. This simplifies automation pipelines and removes the need to maintain auxiliary infrastructure in remote environments.

Leaders lower infrastructure costs and shrink the hardware footprint at the edge by eliminating the compute and storage requirements of a full local registry. This drives a faster time-to-market for remote sites and reduces the long-term maintenance burden of edge deployments.

[User Volumes] Maximize bare metal ROI through unified disk and directory management

Managing storage on bare metal is often complicated by hardware variety, as a single cluster could contain nodes with multiple high-speed drives alongside nodes with only a single disk. Without a unified way to manage these differences, engineers had to choose between rigid, wasteful partitioning or complex workarounds to keep workloads portable, risking disk-full outages on some nodes while leaving expensive hardware under-utilized on others.

Talos Linux 1.12 solves this by bringing physical disks and directories into a unified User Volume framework. Through the new volumeType field, teams can define a consistent storage interface for their workloads regardless of the underlying hardware. For example, a single volume name can map to a dedicated physical disk on high-spec machines or a lightweight host directory on single-disk nodes. This flexibility ensures that stateful workloads can run across the entire cluster without the need for manual, per-node disk configuration.

Engineers achieve operational consistency by standardizing volume names across non-uniform clusters. This ensures that stateful workloads remain portable and predictable, regardless of whether they are backed by raw disks, partitions, or lightweight host directories.

Leaders maximize hardware ROI by ensuring teams can utilize the full storage capacity of every machine in the fleet.

[Talos Linux cluster import] Get Talos Linux clusters on Omni easily and securely

The journey of getting clusters into a centralized management platform is not an easy one. To bring an existing Talos Linux cluster into Omni, teams faced a demanding rip-and-replace project. This meant hours or days of rebuilding nodes from scratch and risking production downtime just to gain visibility and manageability.

Omni now provides an on-ramp for existing infrastructure with the experimental cluster import feature that removes those barriers. With a single CLI command, teams can bring established Talos Linux clusters under Omni management.

Engineers gain immediate visibility and remote management capabilities without the manual toil of a full infrastructure rebuild. No more downtime or added configuration errors.

Leaders accelerate time-to-value by consolidating their fleet into a single management plane while reducing the operational risk associated with manual cluster rebuilds.

Read more about cluster imports for Omni. →

[Kernel args] Enhance remote hardware agility

Kernel arguments control critical system behaviors, such as redirecting a serial console for remote debugging or toggling between power-saving and performance modes. Historically, updating these parameters required a complete system reinstallation or the creation of new boot media. This “rip-and-replace” approach was especially problematic for remote or air-gapped deployments, where any change to low-level settings meant a total loss of node state and a costly manual reset.

Omni now supports modifying kernel arguments on existing machines without the need for reinstallation or custom image manufacturing. This enables persistent, configuration-driven updates to critical parameters such as setting serial output for remote debugging, tweaking certificates for air-gapped security, or preventing automatic restarts during error analysis (panic=0).

Engineers gain the agility to troubleshoot and tune hardware without the friction of a full system wipe. Whether they are adjusting console outputs for remote access or fine-tuning performance governors, they can now manage low-level system changes as standard configuration updates rather than high-risk infrastructure projects.

Leaders lower the cost of remote site maintenance by eliminating the need for specialized one-off OS images for different hardware configurations. Organizations prevent the manual errors associated with physical resets and ensure that senior engineering talent is not wasted on repetitive, high-touch hardware re-provisioning.

Last quarter’s releases transform bare metal into a predictable, software-defined asset that scales with enterprise precision. By implementing staged networking, automated identity governance via OIDC, and granular storage management, teams significantly reduce the operational burden of running Kubernetes reliably at scale.

In practice, this means: Platform engineers spend less time on manual hardware recovery and high-stakes configurations; Security teams gain a more auditable posture with simplified OIDC integration and automated identity governance that synchronizes permissions on every login; and engineering leaders reduce operational risk and truck rolls as well as administrative overhead related to identity management.

Want to be the first to hear about our updates, news, and events? Subscribe to our newsletter.