chore: Talos upgrade to v1.13.8

[syscod3]

Talos upgrade

• Talos: v1.13.8
• Kubernetes: v1.36.2
• Schematic: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba (no official OCI extensions)
• OCI image OCID: ocid1.image.oc1.uk-london-1.aaaaaaaaimtwfuak56iibpaw3ufl7ytdoe2ydxiz4z5ypo3f6xfxl7x24kaa
• Scope: oci-lab is pinned to a different version (v1.14.0-beta.1); its machine classes and cluster-templates/oci-lab.yaml were left untouched.

Check Pluto output for deprecated API versions before merging.

Talos v1.13.8 release notes

Talos 1.13.8 (2026-08-04)

Welcome to the v1.13.8 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.42
CoreDNS: 1.14.6
Flannel: 0.28.8

Talos is built with Go 1.26.5.

Contributors

• Andrey Smirnov
• Mateusz Urbanek
• Noel Georgi
• ctr49
• imusmanmalik
• kastakhov

Changes

14 commits

• siderolabs/talos@3de493227 release(v1.13.8): prepare release
• siderolabs/talos@76de777df chore: update dependencies
• siderolabs/talos@77d5fe2cc chore: update pkgs
• siderolabs/talos@a7db9b227 fix: verify the public key signed images correctly
• siderolabs/talos@d76938912 fix: use context without cancelation for etcd locks
• siderolabs/talos@3a2abc01e fix: redact resource specs in the merge controllers
• siderolabs/talos@153179702 fix(machined): preserve health when services reach running
• siderolabs/talos@fc757545c fix: race with PCR extensions and volume unlock
• siderolabs/talos@2a51fb18f feat: update Flannel to 0.28.8
• siderolabs/talos@05471d31d feat: update CoreDNS to 1.14.6
• siderolabs/talos@9e0b1caba fix: volume mount race (third attempt) around service restart
• siderolabs/talos@c5cb36528 fix: ignore insecure-only imager assets
• siderolabs/talos@c67b10d29 test: update Calico in canal reset test
• siderolabs/talos@9eca6ea4a fix: preserve trailing rate-limited trigger events

Changes from siderolabs/pkgs

6 commits

• siderolabs/pkgs@f677246 chore: update kernel
• siderolabs/pkgs@6c5daf2 chore: replace gnu mirror
• siderolabs/pkgs@4304e87 feat: bump kernel to 6.18.41
• siderolabs/pkgs@e66edeb feat: enable PCF8523 RTC support for arm64
• siderolabs/pkgs@b2e51fc feat: bump kernel to 6.18.40
• siderolabs/pkgs@33195c5 feat: enable CONFIG_NFT_SOCKET in the kernel

Dependency Changes

• github.com/google/cel-go v0.28.0 -> v0.29.0
• github.com/gopacket/gopacket v1.5.0 -> v1.6.1
• github.com/klauspost/compress v1.18.6 -> v1.18.7
• github.com/siderolabs/pkgs v1.13.0-49-g91fe0a0 -> v1.13.0-55-gf677246
• github.com/siderolabs/talos/pkg/machinery v1.13.7 -> v1.13.8
• github.com/sigstore/sigstore-go v1.2.0 -> v1.2.1
• golang.org/x/net v0.55.0 -> v0.57.0
• golang.org/x/sync v0.20.0 -> v0.22.0
• golang.org/x/sys v0.45.0 -> v0.47.0
• golang.org/x/term v0.43.0 -> v0.45.0
• golang.org/x/text v0.37.0 -> v0.40.0
• google.golang.org/grpc v1.81.1 -> v1.82.1

Previous release can be found at v1.13.7

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.6
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.2
registry.k8s.io/kube-controller-manager:v1.36.2
registry.k8s.io/kube-scheduler:v1.36.2
registry.k8s.io/kube-proxy:v1.36.2
ghcr.io/siderolabs/kubelet:v1.36.2
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.8
ghcr.io/siderolabs/installer-base:v1.13.8
ghcr.io/siderolabs/imager:v1.13.8
ghcr.io/siderolabs/talos:v1.13.8
ghcr.io/siderolabs/talosctl-all:v1.13.8
ghcr.io/siderolabs/overlays:v1.13.8
ghcr.io/siderolabs/extensions:v1.13.8