Repository navigation
docs: note that SecureBoot disables kexec reboots - #933
Open
Iheanacho-ai wants to merge 1 commit into
Open
Iheanacho-ai wants to merge 1 commit into
Iheanacho-ai wants to merge 1 commit into
Conversation
Contributor
Preview approval requiredThis pull request comes from a fork, so Mintlify won't build a preview until someone with write access approves commit |
Iheanacho-ai
force-pushed
the
talos-secureboot-kexec
branch
from
November 11, 2026 08:56
8be9d37 to
2425a12
Compare
|
Superseded: a later run (commit |
Talos Linux skips kexec when SecureBoot is enabled, so upgrades and reboots go through the firmware. Say so on the upgrade and SecureBoot pages for v1.14 and v1.15, and split the SecureBoot command examples into command and output blocks. Signed-off-by: Amarachi Iheanacho <amarachi.iheanacho@siderolabs.com>
Iheanacho-ai
force-pushed
the
talos-secureboot-kexec
branch
from
November 11, 2026 09:00
2425a12 to
9a3d096
Compare
sterlingkoch
approved these changes
Nov 11, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Notes that Talos Linux doesn't reboot with
kexecwhen SecureBoot is enabled, on the Upgrading Talos and SecureBoot pages for v1.14 and v1.15.Why
The Upgrading Talos page said that because Talos Linux reboots via
kexec, the extra reboot adds very little time. This isn't true on SecureBoot machines, which reboot through the firmware. A customer saw 25+ minute upgrades for this reason, and the docs had no mention of it (requested by Steve Francis in #team-eng).Change
kexecsentence, added that machines with SecureBoot enabled reboot through the firmware instead, which takes longer. Links to the SecureBoot page.kexec, so upgrades and reboots take as long as a full boot.$prompt with output into a command block and an output block, as the style check requires.Testing
KexecPrepare(internal/app/machined/pkg/runtime/v1alpha1/v1alpha1_sequencer_tasks.go) returns early when SecureBoot is enabled and logskexec skipped as secure boot is enabled. It runs for upgrades, and reboots go through the same check. The check is present in v1.13.0, v1.14.0, and main.make style-check-changed-local(0 errors),make check-frontmatter-changed, andmake canonical-links-check. All pass.