updated talos

ansible/ansible.cfg

@@ -30,5 +30,5 @@ cache_plugin=jsonfile
 # ssh arguments to use
 # Leaving off ControlPersist will result in poor performance, so use
 # paramiko on older platforms rather than removing it, -C controls compression use
-ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -i ~/.ssh/ansible
+ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -i ~/.ssh/ansible
 pipelining = true

talos/CLAUDE.md

@@ -6,9 +6,9 @@ This document contains notes on how the Talos home cluster was created and how t
 
 - **Cluster Name**: home-cluster
 - **Kubernetes Version**: v1.36.1
-- **Talos Version**: v1.13.3
+- **Talos Version**: v1.13.5
 - **Control Plane Nodes**: 3 (10.0.15.1-3)
-- **Worker Nodes**: 4 (10.0.15.4-7)
+- **Worker Nodes**: 3 (10.0.15.4-6)
 - **API Endpoint**: https://10.0.15.1:6443
 
 ## Node Details
@@ -21,7 +21,6 @@ This document contains notes on how the Talos home cluster was created and how t
 | talos-worker1 | Worker | 10.0.15.4 | node1 | 210 | BC:24:11:43:3F:FF |
 | talos-worker2 | Worker | 10.0.15.5 | node2 | 211 | BC:24:11:62:C4:8F |
 | talos-worker3 | Worker | 10.0.15.6 | node3 | 212 | BC:24:11:3F:8E:1A |
-| talos4 | Worker | 10.0.15.7 | bare-metal (HP t620) | — | 7C:D3:0A:12:C8:7E |
 
 ## Prerequisites
 
@@ -76,9 +75,6 @@ talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.3 --file control
 talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.4 --file worker.yaml --config-patch @patches/worker1.yaml --insecure
 talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.5 --file worker.yaml --config-patch @patches/worker2.yaml --insecure
 talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.6 --file worker.yaml --config-patch @patches/worker3.yaml --insecure
-
-# Bare-metal worker (different install disk)
-talosctl --talosconfig talosconfig apply-config --nodes 10.0.15.7 --file worker.yaml --config-patch @patches/worker4.yaml --insecure
 ```
 
 ### 4. Deploy VMs via Terraform
@@ -215,8 +211,6 @@ kubectl get nodes
    ```
    **Critical VM settings**: `cpu: host` is required — without it, Talos boots but never gets a network address. Also set `balloon: 0`, `firewall=0` on NIC.
 
-7. **Bare-Metal Install Disk Enumeration**: On bare-metal nodes booted from a Talos USB, the USB enumerates as `/dev/sda` and the internal drive as `/dev/sdb`. Set `machine.install.disk: /dev/sdb` in the config so Talos installs to the internal drive. After install, when the USB is removed, the internal drive becomes `/dev/sda` in the running system — this is expected and does not require reconfiguration. Example: talos4 (HP t620 with 128GB SK hynix M.2 SATA) was installed this way.
-
 ## Troubleshooting
 
 ### Nodes won't accept new config
@@ -262,10 +256,34 @@ talosctl --talosconfig talosconfig service --nodes 10.0.15.1
 
 ### Upgrading Talos
 
+**Pre-upgrade checklist:**
+1. Check current versions: `for ip in 10.0.15.{1..6}; do echo -n "$ip: "; talosctl --talosconfig talosconfig version --nodes $ip 2>&1 | grep "Tag:" | grep -v Client; done`
+2. Check latest release: `curl -sL https://github.com/siderolabs/talos/releases/latest | grep -o 'v[0-9]\+\.[0-9]\+\.[0-9]\+' | head -1`
+3. Verify cluster health: `kubectl get nodes -o wide`
+4. Check extensions on workers: `talosctl --talosconfig talosconfig get extensions -n 10.0.15.4`
+
+**Important:** CP nodes use the **stock** installer image. Worker nodes use the **factory** image (with iscsi-tools + util-linux-tools extensions). They MUST be upgraded separately with their respective images.
+
 ```bash
-talosctl --talosconfig talosconfig upgrade --image ghcr.io/siderolabs/installer:v1.13.3
+# 1. Upgrade control plane nodes (stock image)
+talosctl --talosconfig talosconfig upgrade \
+  --nodes 10.0.15.1,10.0.15.2,10.0.15.3 \
+  --image ghcr.io/siderolabs/installer:v<VERSION>
+
+# 2. Upgrade worker nodes (factory image with extensions)
+#    The schematic ID can be found via: talosctl --talosconfig talosconfig get extensions -n <worker-ip>
+talosctl --talosconfig talosconfig upgrade \
+  --nodes 10.0.15.4,10.0.15.5,10.0.15.6 \
+  --image factory.talos.dev/installer/<SCHEMATIC_ID>:v<VERSION>
+
+# 3. If workers fail to auto-reboot/uncordon, do it manually:
+talosctl --talosconfig talosconfig reboot --nodes 10.0.15.4,10.0.15.5,10.0.15.6
+# Wait ~90s for reboot, then:
+kubectl uncordon talos-worker1 talos-worker2 talos-worker3
 ```
 
+**Factory schematic ID (as of v1.13.5):** `613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245` (extensions: iscsi-tools v0.2.0, util-linux-tools 2.41.4)
+
 ### Upgrading Kubernetes
 
 ```bash

talos/patches/worker4.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1alpha1
-kind: HostnameConfig
-hostname: talos4
----
-machine:
-  install:
-    disk: /dev/sdb