siderolabs/image-factory v1.7.0

on GitHub

image-factory 1.7.0 (2026-09-07)

Welcome to the v1.7.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

API Tokens

Download tokens and node tokens are now one self-issued API token with atomic, resource-first capabilities.
The catalog is image:read, source:pull, schematic:create, schematic:read, report:read, token:issue, token:read and token:revoke. One code-defined route map validates every scope and authorizes every request; there are no deployment-defined meanings or compatibility aliases for the unreleased intermediate names.

Generated image downloads, PXE assets and generated installer OCI pulls share image:read. Proxied upstream OCI images use the distinct source:pull capability. Schematic creation, schematic reading, report reading, token issuance, token listing and token revocation are independent permissions.

Executable capabilities and delegation are separate. The JWT scope claim controls what the credential may do, while issuable_scopes is an explicit ceiling on what it may grant. Child capabilities and child delegation ceilings must both be subsets of the parent's ceiling. Unknown values fail closed, and no wildcard silently acquires future capabilities.

Each token also carries a stored claim. A stored token is recorded per identity, listed, checked on every use and revocable. An ephemeral token is a signed string and nothing else. Either kind may be used from ?token= on scoped GET and HEAD operations; token-management credentials are refused in query strings because those are copied into access logs.

Lifetime follows storage rather than capability. Stored tokens default to one year and remain revocable. Ephemeral tokens default to five minutes and may live up to eight hours. The CLI bootstrap credential has its own authentication.tokens.ttl.bootstrap policy.

POST /tokens, GET /tokens and POST /tokens/:id/revoke are the only token endpoints. The /node-tokens and /download-token routes are gone; use {"scopes":["image:read"]} and add "stored":false for a short-lived URL credential.

Breaking changes:

• Node and download tokens issued by earlier versions are rejected and must be reissued.
• The intermediate download, pull, schematic, token and admin scope values are rejected.
• POST /tokens accepts stored and issuable_scopes; token records report both executable and issuable scopes.
• Token TTL configuration is grouped under authentication.tokens.ttl.stored, .ephemeral and .bootstrap.
• pkg/client's TokenCreate takes a stored argument; DownloadToken passes false and otherwise keeps its behavior.
• authentication.downloadTokenKeyPath, authentication.downloadTokenTTL and enterprise.nodeTokens move to authentication.tokens; stale keys fail startup.
• authentication.tokens.keyPaths is ordered: the first private key signs new tokens, while every later key or certificate is verification-only. This supports two-phase key rotation without immediately invalidating existing tokens.

See the authentication docs for the complete model and upgrade steps.

Bootstrap Credentials

Cross-subject provisioning uses a CLI-only bootstrap credential rather than an admin scope. It carries token:issue, token:read and token:revoke for its own operations, an explicit snapshot of the current public catalog in issuable_scopes, and the independent any_subject claim.

No HTTP request can create this credential. The Enterprise-only command is:

image-factory admin-token --config /etc/image-factory/config.yaml --subject org_abc123

The command writes the token to stdout and diagnostics to stderr. --ttl uses authentication.tokens.ttl.bootstrap, and authentication.tokens.keyPaths must contain an active private key so the credential is signed by the key running replicas trust.

The bootstrap credential is never recorded, so expiry or removal of its signing key from keyPaths retires it. It cannot propagate any_subject, cannot create a successor bootstrap credential, and cannot be used through ?token=. Keep it offline and give it the shortest practical lifetime.

POST /tokens normally issues to the caller identity. A bootstrap credential may supply subject to provision another identity; listing and revocation remain per-identity.

Contributors

• Andrey Smirnov
• Mateusz Urbanek
• Noel Georgi
• Maja Bojarska
• Dmitrii Sharshakov
• Ivan Demchuk
• Mateusz Urbanek
• Oscar Wieman
• Sacha Weatherstone
• Utku Ozdemir

Changes

Changes from siderolabs/go-debug

Changes from siderolabs/go-vex

Changes from siderolabs/pkgs

Changes from siderolabs/talos

Dependency Changes

• github.com/getkin/kin-openapi v0.146.0 new
• github.com/siderolabs/go-debug v0.6.2 -> v0.6.3
• github.com/siderolabs/go-vex v0.1.2 -> v0.1.4
• github.com/siderolabs/pkgs v1.14.0-10-g13c7afc -> v1.14.0-15-g2f03590
• github.com/siderolabs/talos 322de8bf2974 -> 09681e895fe6
• github.com/siderolabs/talos/pkg/machinery 322de8bf2974 -> 09681e895fe6
• github.com/stretchr/testify v1.11.1 -> v1.12.1
• golang.org/x/crypto v0.55.0 -> v0.56.0

Previous release can be found at v1.6.0