v1.7.0

image-factory 1.7.0 (2026-09-07)

Welcome to the v1.7.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

API Tokens

Download tokens and node tokens are now one self-issued API token with atomic, resource-first capabilities.
The catalog is image:read, source:pull, schematic:create, schematic:read, report:read, token:issue, token:read and token:revoke. One code-defined route map validates every scope and authorizes every request; there are no deployment-defined meanings or compatibility aliases for the unreleased intermediate names.

Generated image downloads, PXE assets and generated installer OCI pulls share image:read. Proxied upstream OCI images use the distinct source:pull capability. Schematic creation, schematic reading, report reading, token issuance, token listing and token revocation are independent permissions.

Executable capabilities and delegation are separate. The JWT scope claim controls what the credential may do, while issuable_scopes is an explicit ceiling on what it may grant. Child capabilities and child delegation ceilings must both be subsets of the parent's ceiling. Unknown values fail closed, and no wildcard silently acquires future capabilities.

Each token also carries a stored claim. A stored token is recorded per identity, listed, checked on every use and revocable. An ephemeral token is a signed string and nothing else. Either kind may be used from ?token= on scoped GET and HEAD operations; token-management credentials are refused in query strings because those are copied into access logs.

Lifetime follows storage rather than capability. Stored tokens default to one year and remain revocable. Ephemeral tokens default to five minutes and may live up to eight hours. The CLI bootstrap credential has its own authentication.tokens.ttl.bootstrap policy.

POST /tokens, GET /tokens and POST /tokens/:id/revoke are the only token endpoints. The /node-tokens and /download-token routes are gone; use {"scopes":["image:read"]} and add "stored":false for a short-lived URL credential.

Breaking changes:

• Node and download tokens issued by earlier versions are rejected and must be reissued.
• The intermediate download, pull, schematic, token and admin scope values are rejected.
• POST /tokens accepts stored and issuable_scopes; token records report both executable and issuable scopes.
• Token TTL configuration is grouped under authentication.tokens.ttl.stored, .ephemeral and .bootstrap.
• pkg/client's TokenCreate takes a stored argument; DownloadToken passes false and otherwise keeps its behavior.
• authentication.downloadTokenKeyPath, authentication.downloadTokenTTL and enterprise.nodeTokens move to authentication.tokens; stale keys fail startup.
• authentication.tokens.keyPaths is ordered: the first private key signs new tokens, while every later key or certificate is verification-only. This supports two-phase key rotation without immediately invalidating existing tokens.

See the authentication docs for the complete model and upgrade steps.

Bootstrap Credentials

Cross-subject provisioning uses a CLI-only bootstrap credential rather than an admin scope. It carries token:issue, token:read and token:revoke for its own operations, an explicit snapshot of the current public catalog in issuable_scopes, and the independent any_subject claim.

No HTTP request can create this credential. The Enterprise-only command is:

image-factory admin-token --config /etc/image-factory/config.yaml --subject org_abc123

The command writes the token to stdout and diagnostics to stderr. --ttl uses authentication.tokens.ttl.bootstrap, and authentication.tokens.keyPaths must contain an active private key so the credential is signed by the key running replicas trust.

The bootstrap credential is never recorded, so expiry or removal of its signing key from keyPaths retires it. It cannot propagate any_subject, cannot create a successor bootstrap credential, and cannot be used through ?token=. Keep it offline and give it the shortest practical lifetime.

POST /tokens normally issues to the caller identity. A bootstrap credential may supply subject to provision another identity; listing and revocation remain per-identity.

Contributors

• Andrey Smirnov
• Mateusz Urbanek
• Noel Georgi
• Maja Bojarska
• Dmitrii Sharshakov
• Ivan Demchuk
• Mateusz Urbanek
• Oscar Wieman
• Sacha Weatherstone
• Utku Ozdemir

Changes

15 commits

• 5da8c30 release(v1.7.0): prepare release
• 513036c fix: cache unauthenticated iPXE scripts, dedupe cache signing
• 5fec48b test: characterize HTTP frontend behavior
• 4520b38 fix(enterprise): evaluate VEX against Talos kernel
• a27dfe6 feat: enforce public API with OpenAPI
• 773ba3c fix(ui): gate token create modal on the in-flight POST
• 2e149c8 fix(auth0): drop Bearer challenge from 401 response
• 9f82dde fix: rename registryClientRefreshInterval to refreshInterval
• f4f79db feat(enterprise): repo-per-org token storage, url-safe stored tokens
• f4e4d01 feat(enterprise): expose actor profiles for token creation UI
• 8a77753 feat(enterprise): replace scope enum with route-defined capability scopes
• 4d9710f feat(enterprise): add CLI-only admin token scope
• 4286666 feat(enterprise): unify download and node tokens as scoped API tokens
• 4becd5d release(v1.6.1): prepare release
• e5ff748 fix: pull in Talos for the SBC/GRUB/EFI fix

Changes from siderolabs/go-debug

1 commit

• 44d6398 feat: support Go 1.27

Changes from siderolabs/go-vex

2 commits

• 221fa7a fix: reject unknown VEX fields and parse kernel SPDX versions
• ebbfce6 feat: support kernelVersionRanges in statements

Changes from siderolabs/pkgs

5 commits

• 2f03590 chore: update tools
• 2638a41 fix: preserve symlinks for libudev
• d72f498 feat: update kernel to 6.18.48
• 3a3fc4d feat: bump kernel to 6.18.47
• 8a1612e feat: expose more software as pkgs

Changes from siderolabs/talos

52 commits

• 09681e895 fix: correct the bug with overlay assets in ESP being dropped
• 9abd05af4 release(v1.14.0): prepare release
• ff772d64f chore: mark release as stable
• 5424dac73 test: relax OOM test conditions
• 9f6719422 fix: normalize image reference when passing to image verification flow
• 6ce58d308 fix: name diskSelector in UnattendedInstallConfig validation errors
• af4e11b50 test: isolate base OCI spec test in BGP CLOS runs
• ff56b6d66 chore: update tools and pkgs
• 8c8b9b45f fix: filter the output in talosctl
• 9777a1bb4 feat: talos containers run with imagegccontroller
• dd566c9c7 fix: container mount rshared propagation
• 2f8931768 refactor: don't skip container tests in short mode
• 2f0fdd11e fix: ctr machinedaccss allowed roles
• 64aef9053 feat: containers can connect to machined
• ce2148aa0 feat: impl. container mount controller
• 9105c5e1e feat: talos containers support for talosctl
• 36fd44677 feat: impl. container runtime controller
• afc09d418 refactor: make runner.runner context-native
• eff936cf0 feat: impl ContainerInstanceController
• 95abc8bff fix: filter out passed metadata in API proxying
• 10c4f1a8b fix: treat desired roles empty as error in Talos API access
• 807b692a1 fix: allow CSI volumes to be mounted with an SELinux context
• 6249f3f4e test: skip filemap heap test under race detector
• 87a031b7f test: libvirtd extensions
• e8b376365 fix: validate received kubeconfig
• abce4c937 fix: use os.Root in the talosctl extract path
• 1deae73dd fix: escape output in the talosctl dashboard
• 5b153233c chore: speed up unit-tests
• 3715ce908 fix: add checks for meta key in the API path
• 138958053 feat: update COSI to 1.16.3
• bdc7f3053 fix: preserve shared libs symlinks
• 7366edc90 chore: reduce verbosity of the grype scan
• c027a947f fix: exclude scheduler config from apiserver config version
• 544fc52cb feat: add host extension pre-shutdown hooks
• 1d911581d fix: route creation churning every 100ms
• baca68d0d fix: drop dead legacy registries init from worker generation
• dec9dc3dc chore: bump sigstore/rekor to v1.5.4
• dc9e7fea9 chore: add SPD5118 driver to squashfs
• ae4d8228e fix: keep the time sync boot timeout across a syncer restart
• 755900fcc fix: preserve special modes when extracting files
• 6c927a0ff fix: hostns etc mount
• 3cdd0e748 feat: bump kubernetes to 1.37.0
• 03c567929 refactor: log filter stays enabled on enter press
• b690b7ad5 fix: write the uploaded etcd snapshot atomically
• 25a366162 chore: update multipath notes
• 866db94f1 fix: drop gRPC client keepalive aggressive settings in the tracker
• 74e88bd57 feat: support host extension services
• e828fe80a fix: skip selinux label for read-only/detached/external mounts
• 1be6787a5 fix: capture packets correctly on VLANs
• d16d765f7 docs: update CRI customization example
• 1b31e1213 fix: use os.Root in the untar path
• 91a6af032 fix: enable additional SELinux permissions for Cilium

Dependency Changes

• github.com/getkin/kin-openapi v0.146.0 new
• github.com/siderolabs/go-debug v0.6.2 -> v0.6.3
• github.com/siderolabs/go-vex v0.1.2 -> v0.1.4
• github.com/siderolabs/pkgs v1.14.0-10-g13c7afc -> v1.14.0-15-g2f03590
• github.com/siderolabs/talos 322de8bf2974 -> 09681e895fe6
• github.com/siderolabs/talos/pkg/machinery 322de8bf2974 -> 09681e895fe6
• github.com/stretchr/testify v1.11.1 -> v1.12.1
• golang.org/x/crypto v0.55.0 -> v0.56.0

Previous release can be found at v1.6.0