tuppr

A Kubernetes controller for automated, orchestrated upgrades of Talos Linux and Kubernetes. Declare a target version in a custom resource; tuppr plans and executes the rollout - draining, upgrading, rebooting, and health-checking each node in turn (or in parallel batches) - always driving the upgrade from a healthy node, so it never self-upgrades the node it runs on.

📖 Docs site: - requirements, quickstart, upgrade coordination, Talos and Kubernetes upgrade options, notifications (Apprise + chaski), monitoring, operations, and chart values.

When to use it

• You run Talos Linux and want version upgrades driven by the Kubernetes API

• You want the rollout orchestrated: health-gated, one plan at a time, with

• You want to keep the Kubernetes version in step through the same declarative

When _not_ to use it

• You need tuppr to pick a _safe_ version for you. It upgrades to exactly the

• You are not on Talos. tuppr drives upgrades over the Talos API; it is not a

The two resources

tuppr manages two kinds of upgrade in the tuppr.home-operations.com/v1alpha1 API group. Only one upgrade ever runs at a time cluster-wide: multiple TalosUpgrade plans queue, and the two kinds never run concurrently (see Upgrade coordination).

| Resource | Upgrades | Reboot | Per cluster | | ------------------- | ---------------------- | ------ | ------------------------------ | | TalosUpgrade | Talos Linux on nodes | Yes | Many (queued), node-selectable | | KubernetesUpgrade | The Kubernetes version | No | Exactly one |

Quickstart

Grant the controller's namespace os:admin Talos API access (apply to every node), then install the chart. Full prerequisites: Requirements.

# machine config, on every node
machine:
  features:
    kubernetesTalosAPIAccess:
      enabled: true
      allowedRoles: [os:admin]
      allowedKubernetesNamespaces: [system-upgrade]

helm install tuppr oci://ghcr.io/home-operations/charts/tuppr \
  --namespace system-upgrade

Upgrade Talos (rolls the version across matching nodes, health-gated):

apiVersion: tuppr.home-operations.com/v1alpha1
kind: TalosUpgrade
metadata:
  name: cluster
spec:
  talos:
    # renovate: datasource=docker depName=ghcr.io/siderolabs/talos
    version: v1.14.1

Upgrade Kubernetes (one resource per cluster; edit the version to upgrade again):

apiVersion: tuppr.home-operations.com/v1alpha1
kind: KubernetesUpgrade
metadata:
  name: kubernetes
spec:
  kubernetes:
    # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
    version: v1.37.0

Then kubectl get talosupgrade -w. Health checks, parallel batches, hooks, maintenance windows, and per-node overrides: Talos upgrades.

Development

Tooling is pinned with mise: mise run test, mise run lint, mise run build, mise run manifests. The docs site builds with mise run docs (strict link checking) and serves locally with mise run docs-serve. See Development.

License

AGPL-3.0. Inspired by Talos Linux and the System Upgrade Controller.