> ## Documentation Index
> Fetch the complete documentation index at: https://siderolabs-fe86397c-config-evolution.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Upgrading Talos Linux

> Guide to upgrading a Talos Linux machine.

export const release_v1_14 = 'v1.14.0-beta.0';

export const VersionWarningBanner = () => {
  const latestVersion = "v1.13";
  const [latestUrl, setLatestUrl] = useState(null);
  const [currentVersion, setCurrentVersion] = useState(null);
  const [isBeta, setIsBeta] = useState(false);
  const parseVersion = v => v.replace("v", "").split(".").map(Number);
  const isGreaterVersion = (a, b) => {
    const [aMajor, aMinor] = parseVersion(a);
    const [bMajor, bMinor] = parseVersion(b);
    if (aMajor > bMajor) return true;
    if (aMajor === bMajor && aMinor > bMinor) return true;
    return false;
  };
  useEffect(() => {
    if (typeof window === "undefined") return;
    const {pathname, hash, search} = window.location;
    const match = pathname.match(/\/talos\/(v\d+\.\d+)\//);
    if (!match) return;
    const detectedVersion = match[1];
    if (detectedVersion === latestVersion) return;
    setCurrentVersion(detectedVersion);
    if (isGreaterVersion(detectedVersion, latestVersion)) {
      setIsBeta(true);
    }
    const newPath = pathname.replace(`/talos/${detectedVersion}/`, `/talos/${latestVersion}/`);
    setLatestUrl(`${newPath}${search}${hash}`);
  }, []);
  if (!latestUrl || !currentVersion) return null;
  return <div className="not-prose sticky top-6 z-50 my-6">
      <div className="border border-yellow-500/30 bg-yellow-500/10 px-4 py-3 rounded-xl">
        <div className="text-sm">
          {isBeta ? <>
              ⚠️ You are viewing a <strong>beta version</strong> of Talos ({currentVersion}).
              This version may be unstable.
              <a href={latestUrl} className="ml-2 underline text-yellow-400 hover:text-yellow-300 font-medium">
                View latest stable version {latestVersion} →
              </a>
            </> : <>
              ⚠️ You are viewing an older version of Talos ({currentVersion}).
              <a href={latestUrl} className="ml-2 underline text-yellow-400 hover:text-yellow-300 font-medium">
                View the latest version {latestVersion} →
              </a>
            </>}
        </div>
      </div>
    </div>;
};

<VersionWarningBanner />

OS upgrades are effected by an API call, which can be sent via the `talosctl` CLI utility.

The upgrade API call passes a node the installer image to use to perform the upgrade.

Each Talos version has a corresponding installer image, listed on the release page for the version, for example <a href={`https://github.com/siderolabs/talos/releases/tag/${release_v1_14}`}>{release_v1_14}</a>.

Upgrades use an A-B image scheme in order to facilitate rollbacks.
This scheme retains the previous Talos kernel and OS image following each upgrade.
If an upgrade fails to boot, Talos will roll back to the previous version.
Likewise, Talos may be manually rolled back via API (or `talosctl rollback`), which will update the boot reference and reboot.

*Note* An upgrade of the Talos Linux OS will not (since v1.0) apply an upgrade to the Kubernetes version by default.
Kubernetes upgrades should be managed separately per [upgrading kubernetes](../../../../kubernetes-guides/advanced-guides/upgrading-kubernetes).

## Supported upgrade paths

Because Talos Linux is image based, an upgrade is almost the same as installing Talos, with the difference that the system has already been initialized with a configuration.
The supported configuration may change between versions.
The upgrade process should handle such changes transparently, but this migration is only tested between adjacent minor releases.
Thus the recommended upgrade path is to always upgrade to the latest patch release of all intermediate minor releases.

For example, if upgrading from Talos 1.0 to Talos 1.2.4, the recommended upgrade path would be:

* upgrade from 1.0 to latest patch of 1.0 - to v1.0.6
* upgrade from v1.0.6 to latest patch of 1.1 - to v1.1.2
* upgrade from v1.1.2 to v1.2.4

## Before upgrade to {release_v1_14}

Talos v1.13 onwards now supports NVIDIA GPU via the gpu-operator.

### NVIDIA GPU users

Talos 1.13 now supports configuring NVIDIA GPU via the gpu-operator.

If using NVIDIA GPU on DGX systems, follow the [NVIDIA proprietary driver guide](../hardware-and-drivers/nvidia-gpu-proprietary).
DGX systems are only known to work with the proprietary driver as of now.

Before upgrading to Talos 1.13, uninstall the nvidia-device-plugin helm chart and delete the nvidia runtimeclass.

Uninstall the nvidia-device-plugin helm chart:

First list all helm installs:

```bash theme={null}
helm list -A
```

Find the helm release for the nvidia-device-plugin and uninstall it:

```bash theme={null}
helm uninstall -n <namespace> <release-name>
```

Now delete the nvidia runtimeclass:

```bash theme={null}
kubectl delete runtimeclass nvidia
```

Now follow the instructions in [NVIDIA GPU (OSS drivers)](../hardware-and-drivers/nvidia-gpu) or [NVIDIA GPU (Proprietary drivers)](../hardware-and-drivers/nvidia-gpu-proprietary) guide to switch to the new gpu-operator based configuration.

## Video walkthrough

To see a live demo of an upgrade of Talos Linux, see the video below:

<iframe width="560" height="315" src="https://www.youtube.com/embed/AAF6WhX0USo" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen />

## After upgrade to {release_v1_14}

There are no specific actions to be taken after an upgrade.

## `talosctl upgrade`

To upgrade a Talos node, specify the node's IP address and the
installer container image for the version of Talos to upgrade to.

For instance, if your Talos node has the IP address `10.20.30.40` and you want
to install the current version, you would enter a command such
as:

<CodeBlock lang="sh">
  {`
    talosctl upgrade --nodes 10.20.30.40 \\
    --image ghcr.io/siderolabs/installer:${release_v1_14}
    `}
</CodeBlock>

Note that because Talos Linux reboots via the `kexec` syscall, the extra reboot adds very little time.

### Upgrade API changes in Talos v1.13

Talos v1.13 introduces a new streaming upgrade API via `LifecycleService.Upgrade`.
The `talosctl upgrade` command now uses this new API by default, providing real-time progress reporting and support for parallel upgrades across multiple nodes.

New flags:

* `--progress <mode>` - Controls the output mode for upgrade progress. Values: `auto` (default), `plain`. `auto` uses a dynamic progress reporter if the output is a terminal, and falls back to plain text otherwise. `plain` always uses plain text output.
* `--namespace <name>` - Containerd namespace to use for the upgrade image. Values: `system` (default), `cri`, `inmem`.

The `--reboot-mode` flag now supports three values: `default`, `powercycle`, and `force`.

> **Deprecation notice**
> The legacy upgrade flags (`--force`, `--insecure`, `--preserve`, `--stage`) are deprecated and will be removed in Talos 1.18.
> These flags are only used when falling back to the legacy `MachineService.Upgrade` API for older Talos versions.

## Machine configuration changes

Talos 1.14 continues splitting the monolithic `v1alpha1` document into small, focused configuration documents.
Every `v1alpha1` field listed below is deprecated, but still supported, so a machine configuration which only uses `v1alpha1` keeps working after the upgrade.
Unless noted otherwise, a deprecated field and its replacement document are mutually exclusive: a configuration which sets both is rejected.

### Kubernetes

Kubernetes configuration is now expressed as a set of dedicated documents; new Kubernetes features and settings will only be available in the new documents.
`kube-proxy` is now configured with a configuration file (via [KubeProxyConfig](../../reference/configuration/kubernetes/kubeproxyconfig)) instead of command line arguments.

| Deprecated `v1alpha1` field                                                                                                                                                                                                  | Replacement document                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `.cluster.clusterName`, `.cluster.controlPlane.endpoint`                                                                                                                                                                     | [KubeClusterConfig](../../reference/configuration/kubernetes/kubeclusterconfig)                                                                                                                                                                                                                                                                                                                                                                                       |
| `.cluster.apiServer`, `.cluster.controlPlane.localAPIServerPort`                                                                                                                                                             | [KubeAPIServerConfig](../../reference/configuration/kubernetes/kubeapiserverconfig), [KubeAdmissionControlConfig](../../reference/configuration/kubernetes/kubeadmissioncontrolconfig), [KubeAuditPolicyConfig](../../reference/configuration/kubernetes/kubeauditpolicyconfig), [KubeAuthenticationConfig](../../reference/configuration/kubernetes/kubeauthenticationconfig), [KubeAuthorizerConfig](../../reference/configuration/kubernetes/kubeauthorizerconfig) |
| `.cluster.ca`, `.cluster.acceptedCAs`                                                                                                                                                                                        | [KubeAPIServerCAConfig](../../reference/configuration/kubernetes/kubeapiservercaconfig)                                                                                                                                                                                                                                                                                                                                                                               |
| `.cluster.aggregatorCA`                                                                                                                                                                                                      | [KubeAggregatorCAConfig](../../reference/configuration/kubernetes/kubeaggregatorcaconfig)                                                                                                                                                                                                                                                                                                                                                                             |
| `.cluster.serviceAccount`                                                                                                                                                                                                    | [KubeServiceAccountConfig](../../reference/configuration/kubernetes/kubeserviceaccountconfig)                                                                                                                                                                                                                                                                                                                                                                         |
| `.cluster.controllerManager`, `.machine.controlPlane.controllerManager`                                                                                                                                                      | [KubeControllerManagerConfig](../../reference/configuration/kubernetes/kubecontrollermanagerconfig)                                                                                                                                                                                                                                                                                                                                                                   |
| `.cluster.scheduler`, `.machine.controlPlane.scheduler`                                                                                                                                                                      | [KubeSchedulerConfig](../../reference/configuration/kubernetes/kubeschedulerconfig)                                                                                                                                                                                                                                                                                                                                                                                   |
| `.cluster.proxy`                                                                                                                                                                                                             | [KubeProxyConfig](../../reference/configuration/kubernetes/kubeproxyconfig)                                                                                                                                                                                                                                                                                                                                                                                           |
| `.cluster.network`                                                                                                                                                                                                           | [KubeNetworkConfig](../../reference/configuration/kubernetes/kubenetworkconfig), [KubeFlannelCNIConfig](../../reference/configuration/kubernetes/kubeflannelcniconfig)                                                                                                                                                                                                                                                                                                |
| `.cluster.coreDNS`                                                                                                                                                                                                           | [KubeCoreDNSConfig](../../reference/configuration/kubernetes/kubecorednsconfig)                                                                                                                                                                                                                                                                                                                                                                                       |
| `.cluster.aescbcEncryptionSecret`, `.cluster.secretboxEncryptionSecret`                                                                                                                                                      | [KubeEtcdEncryptionConfig](../../reference/configuration/kubernetes/kubeetcdencryptionconfig)                                                                                                                                                                                                                                                                                                                                                                         |
| `.cluster.inlineManifests`                                                                                                                                                                                                   | [KubeInlineManifestConfig](../../reference/configuration/kubernetes/kubeinlinemanifestconfig)                                                                                                                                                                                                                                                                                                                                                                         |
| `.cluster.extraManifests`, `.cluster.extraManifestHeaders`                                                                                                                                                                   | [KubeExternalManifestConfig](../../reference/configuration/kubernetes/kubeexternalmanifestconfig)                                                                                                                                                                                                                                                                                                                                                                     |
| `.cluster.allowSchedulingOnControlPlanes`, `.machine.nodeLabels`, `.machine.nodeAnnotations`, `.machine.nodeTaints`, `.machine.kubelet.nodeIP`, `.machine.kubelet.registerWithFQDN`, `.machine.kubelet.skipNodeRegistration` | [KubeNodeConfig](../../reference/configuration/kubernetes/kubenodeconfig)                                                                                                                                                                                                                                                                                                                                                                                             |
| `.machine.kubelet` (remaining fields)                                                                                                                                                                                        | [KubeletConfig](../../reference/configuration/kubernetes/kubeletconfig), [KubeCredentialProviderConfig](../../reference/configuration/kubernetes/kubecredentialproviderconfig) (for `.machine.kubelet.credentialProviderConfig`)                                                                                                                                                                                                                                      |
| `.machine.pods`                                                                                                                                                                                                              | [KubeStaticPodConfig](../../reference/configuration/kubernetes/kubestaticpodconfig)                                                                                                                                                                                                                                                                                                                                                                                   |
| `.machine.features.kubePrism`                                                                                                                                                                                                | [KubePrismConfig](../../reference/configuration/kubernetes/kubeprismconfig) (remove the document to disable KubePrism)                                                                                                                                                                                                                                                                                                                                                |
| `.machine.features.kubernetesTalosAPIAccess`                                                                                                                                                                                 | [KubeTalosAPIAccessConfig](../../reference/configuration/kubernetes/kubetalosapiaccessconfig)                                                                                                                                                                                                                                                                                                                                                                         |
| `.cluster.discovery`                                                                                                                                                                                                         | [DiscoveryServiceConfig](../../reference/configuration/cluster/discoveryserviceconfig)                                                                                                                                                                                                                                                                                                                                                                                |
| `.cluster.id`, `.cluster.secret`                                                                                                                                                                                             | [DiscoveryIdentityConfig](../../reference/configuration/cluster/discoveryidentityconfig)                                                                                                                                                                                                                                                                                                                                                                              |

Other Kubernetes configuration changes:

* [DiscoveryServiceConfig](../../reference/configuration/cluster/discoveryserviceconfig) is a multi-document kind, so multiple discovery service endpoints can be configured now.
* The cluster ID encoding in the generated secrets bundle changed from `base64.URLEncoding` to `base64.StdEncoding` to align with the rest of Talos.
* The default control plane `NoSchedule` taint and the control plane node label are now listed explicitly in [KubeNodeConfig](../../reference/configuration/kubernetes/kubenodeconfig).
* [KubeNetworkConfig](../../reference/configuration/kubernetes/kubenetworkconfig) adds `nodeCIDRMaskSizeIPv4` (default `24`) and `nodeCIDRMaskSizeIPv6` (default `64`) to control the per-node pod CIDR mask size; pod and service subnet sizes are validated against them.
* `.machine.kubelet.extraMounts` has no equivalent in the new documents, and `.machine.kubelet.disableManifestsDirectory` is locked to `true` there.

### Kernel and udev

If both the deprecated `v1alpha1` field and the new document are used, the new document takes precedence for conflicting settings.

| Deprecated `v1alpha1` field | Replacement document                                                           |
| --------------------------- | ------------------------------------------------------------------------------ |
| `.machine.sysctls`          | [SysctlConfig](../../reference/configuration/runtime/sysctlconfig)             |
| `.machine.sysfs`            | [SysfsConfig](../../reference/configuration/runtime/sysfsconfig)               |
| `.machine.kernel.modules`   | [KernelModuleConfig](../../reference/configuration/runtime/kernelmoduleconfig) |
| `.machine.udev.rules`       | [UdevRulesConfig](../../reference/configuration/runtime/udevrulesconfig)       |

### Install, files and container runtime

* `.machine.install` is deprecated in favor of the new [UnattendedInstallConfig](../../reference/configuration/runtime/unattendedinstallconfig) document, which carries the installer `image` and a `provisioning` section with a CEL `volumeSelector` to match the install disk.
  `talosctl gen config` and `talosctl cluster create` generate this document by default now; `.machine.install` is still used for older version contracts.
* `.machine.files` is deprecated in favor of dedicated documents: [EtcFileConfig](../../reference/configuration/runtime/etcfileconfig) for user-owned files under `/etc` (the document `name` is the path relative to `/etc`), and [CRICustomizationConfig](../../reference/configuration/cri/cricustomizationconfig) for CRI configuration.
  Talos-managed paths (`resolv.conf`, `hosts`, `machine-id`, CRI and Kubernetes configuration, trust bundles and identity files) are rejected by `EtcFileConfig`.
* New [CRICustomizationConfig](../../reference/configuration/cri/cricustomizationconfig) document carries a TOML fragment merged into the CRI containerd configuration; fragments are merged in lexicographical order by document name.
  The legacy `/etc/cri/conf.d/20-customization.part` machine file is still supported and is exposed under the reserved name `customization`.
  CRI configuration changes no longer require a reboot.
* `.machine.baseRuntimeSpecOverrides` is deprecated in favor of the new [CRIBaseRuntimeSpecConfig](../../reference/configuration/cri/cribaseruntimespecconfig) document.
* `.machine.features.imageCache` is deprecated in favor of the new [ImageCacheConfig](../../reference/configuration/cri/imagecacheconfig) document, where `localEnabled` becomes `local.enabled`.
  The deprecated field is still honored, so upgraded clusters keep their image cache enabled, but the field and the document cannot both be set.
* New [SecurityProfileConfig](../../reference/configuration/runtime/securityprofileconfig) document with the `workloadIsolation` option (enabled by default for new clusters generated with Talos 1.14, absent — and therefore disabled — on upgraded clusters).
* [OOMConfig](../../reference/configuration/runtime/oomconfig) has a new `strictCgroupClassOrdering` option (defaults to `true`) to enforce QoS class ordering when picking an OOM victim.

### Network

* `.machine.features.hostDNS` is deprecated: host DNS is now configured with the `hostDNS` section of the [ResolverConfig](../../reference/configuration/network/resolverconfig) document.
* [ResolverConfig](../../reference/configuration/network/resolverconfig) nameservers accept a `protocol` (DNS over TLS and DNS over HTTPS are supported now) and a `tlsServerName` setting, configured per nameserver.
* [TimeSyncConfig](../../reference/configuration/network/timesyncconfig) has a new `useNTS` field to enable Network Time Security for custom time servers (NTS is enabled by default for the default `time.cloudflare.com` server).
* [DHCPv4Config](../../reference/configuration/network/dhcpv4config) has a new `ignoreRoutes` option to ignore the default gateway and classless static routes offered by the DHCP server (the connected route for the leased address is still configured).
  DHCPv4 search domains are now applied to the resolver configuration.
* New [VethConfig](../../reference/configuration/network/vethconfig) document to configure virtual Ethernet pairs: both endpoints are created in the host network namespace and support the common link settings, addresses, routes and multicast configuration.
* New [HTTPProbeConfig](../../reference/configuration/network/httpprobeconfig) document to configure HTTP-based connectivity checks (probes).
* New [BGPInstanceConfig](../../reference/configuration/network/bgpinstanceconfig) document to run native BGP speakers on the host (local ASN, router-id, optional Linux VRF, advertised interfaces and neighbors), removing the need for the FRR system extension in fabric-facing setups.
  Routes learned by one instance can be selectively imported into another with `importRoutes`, and `installRoutes: false` keeps learned routes out of the Linux routing table.

### Volumes and storage

* New [FilesystemTrimConfig](../../reference/configuration/block/filesystemtrimconfig) document to enable periodic filesystem trim (the `fstrim` equivalent) with a global `interval`.
  The default machine configuration generated by Talos 1.14 includes it with a one week interval; upgraded clusters don't have the document, so trimming stays disabled until it is added.
  The interval can be overridden or disabled per volume with the new `trim` section of [VolumeConfig](../../reference/configuration/block/volumeconfig), [UserVolumeConfig](../../reference/configuration/block/uservolumeconfig), [ExistingVolumeConfig](../../reference/configuration/block/existingvolumeconfig) and [ExternalVolumeConfig](../../reference/configuration/block/externalvolumeconfig).
* New [FilesystemScrubConfig](../../reference/configuration/block/filesystemscrubconfig) document to enable periodic online filesystem scrub (currently XFS only, via `xfs_scrub`) with a global `interval`.
  Scrubbing is disabled by default, and the generated machine configuration does not include this document, so it stays disabled until it is added.
  The interval can be overridden or disabled per volume with the new `scrub` section of [VolumeConfig](../../reference/configuration/block/volumeconfig), [UserVolumeConfig](../../reference/configuration/block/uservolumeconfig) and [ExistingVolumeConfig](../../reference/configuration/block/existingvolumeconfig).
* Volume encryption has a new `allowDiscards` option (disabled by default) to pass TRIM/discard requests through to the underlying device.
* [VolumeConfig](../../reference/configuration/block/volumeconfig) and [UserVolumeConfig](../../reference/configuration/block/uservolumeconfig) support a new `filesystem.xfs.minAllocationGroupSize` setting (defaults to 64 GiB, set to zero to restore stock `mkfs.xfs` behavior); it only applies to volumes formatted by Talos 1.14 or later.
* The `ETCD`, `CRI`, `KUBELET` and `LOG` system volumes can be placed on dedicated partitions with a [VolumeConfig](../../reference/configuration/block/volumeconfig) document with `provisioning` set (optionally encrypted); by default they remain directories under the `EPHEMERAL` volume.
* The machine configuration generated by Talos 1.14 mounts the `EPHEMERAL` volume (`/var`) with `noexec` in addition to `nosuid` and `nodev`; existing machines are not affected by an upgrade.
  Set `mount.secure` to `false` in the [VolumeConfig](../../reference/configuration/block/volumeconfig) document for `EPHEMERAL` to opt out (this also disables `nosuid` and `nodev`).
* `btrfs` can be used as a filesystem type for user and existing volumes (requires the `btrfs` system extension).
* New [LVMVolumeGroupConfig](../../reference/configuration/storage/lvmvolumegroupconfig) and [LVMLogicalVolumeConfig](../../reference/configuration/storage/lvmlogicalvolumeconfig) documents to declaratively create and grow LVM volume groups and logical volumes.
* New [RAIDArrayConfig](../../reference/configuration/storage/raidarrayconfig) document to declaratively create and grow Linux MD (software RAID) arrays; `raid1` arrays with `metadata: "1.0"` can be used as the install disk.

## Upgrade sequence

When a Talos node receives the upgrade command, it cordons
itself in Kubernetes, to avoid receiving any new workload.
It then starts to drain its existing workload.

**NOTE**: If any of your workloads are sensitive to being shut down ungracefully, be sure to use the `lifecycle.preStop` Pod [spec](https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks).

Once all of the workload Pods are drained, Talos will start shutting down its
internal processes.

Once all the processes are stopped and the services are shut down, the filesystems will be unmounted.
This allows Talos to produce a very clean upgrade, as close as possible to a pristine system.
We verify the disk and then perform the actual image upgrade.
We set the bootloader to boot *once* with the new kernel and OS image, then we reboot.

After the node comes back up and Talos verifies itself, it will make
the bootloader change permanent, rejoin the cluster, and finally uncordon itself to receive new workloads.

## FAQs

**Q.** What happens if an upgrade fails?

**A.** Talos Linux attempts to safely handle upgrade failures.

The most common failure is an invalid installer image reference.
In this case, Talos will fail to download the upgraded image and will abort the upgrade.

Sometimes, Talos is unable to successfully kill off all of the disk access points, in which case it cannot safely unmount all filesystems to effect the upgrade.
In this case, it will abort the upgrade and reboot.

It is possible (especially with test builds) that the upgraded Talos system will fail to start.
In this case, the node will be rebooted, and the bootloader will automatically use the previous Talos kernel and image, thus effectively rolling back the upgrade.

Lastly, it is possible that Talos itself will upgrade successfully, start up, and rejoin the cluster but your workload will fail to run on it, for whatever reason.
This is when you would use the `talosctl rollback` command to revert back to the previous Talos version.

**Q.** Can upgrades be scheduled?

**A.** Because the upgrade sequence is API-driven, you can easily tie it in to your own business logic to schedule and coordinate your upgrades.

**Q.** Can the upgrade process be observed?

**A.** Yes, using the `talosctl dmesg -f` command.
You can also use `talosctl upgrade --wait`, and optionally `talosctl upgrade --wait --debug` to observe kernel logs

**Q.** Are worker node upgrades handled differently from control plane node upgrades?

**A.** Short answer: no.

Long answer:  Both node types follow the same set procedure.
From the user's standpoint, however, the processes are identical.
However, since control plane nodes run additional services, such as etcd, there are some extra steps and checks performed on them.
For instance, Talos will refuse to upgrade a control plane node if that upgrade would cause a loss of quorum for etcd.
If multiple control plane nodes are asked to upgrade at the same time, Talos will protect the Kubernetes cluster by ensuring only one control plane node actively upgrades at any time, via checking etcd quorum.

**Q.** Can I break my cluster by upgrading everything at once?

**A.** Possibly - it's not recommended.

Nothing prevents the user from sending near-simultaneous upgrades to each node of the cluster - and while Talos Linux and Kubernetes can generally deal with this situation, other components of the cluster may not be able to recover from more than one node rebooting at a time.
(e.g. any software that maintains a quorum or state across nodes, such as Rook/Ceph)

**Q.** Which version of `talosctl` should I use to update a cluster?

**A.** We recommend using the version that matches the current running version of the cluster.
