feat: allow excluding Talos releases

In case of broken Talos release, we keep serving it in the UI/API. This
can lead to issues when customers download broken release and try to run
it. We should be able to exclude the broken versions without creating
new release of Image Factory, purely by specifying them in config.

For API completeness, we will also serve /versions?broken=true endpoint
that lists the broken releases that should not be used.

Signed-off-by: Mateusz Urbanek <mateusz.urbanek@siderolabs.com>

Author: shanduur

cmd/image-factory/cmd/options.go

@@ -86,6 +86,10 @@ type AssetBuilderOptions struct {
 	// MinTalosVersion specifies the minimum supported Talos version for assets.
 	MinTalosVersion string `koanf:"minTalosVersion"`
 
+	// BrokenTalosVersions lists Talos versions that should be considered broken and avoided when building assets.
+	// Those are versions that are known to have critical issues that prevent them from working correctly, such as bugs in Talos that cause build failures or runtime errors.
+	BrokenTalosVersions []string `koanf:"brokenTalosVersions"`
+
 	// MaxConcurrency sets the maximum number of simultaneous asset build operations.
 	MaxConcurrency int `koanf:"maxConcurrency"`
 }

cmd/image-factory/cmd/service.go

@@ -449,8 +449,22 @@ func buildArtifactsManager(logger *zap.Logger, opts Options) (*artifacts.Manager
 		return nil, fmt.Errorf("failed to parse minimum Talos version: %w", err)
 	}
 
+	brokenVersions := make([]semver.Version, 0, len(opts.Build.BrokenTalosVersions))
+
+	for _, v := range opts.Build.BrokenTalosVersions {
+		var parsed semver.Version
+
+		parsed, err = semver.Parse(v)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse broken Talos version %q: %w", v, err)
+		}
+
+		brokenVersions = append(brokenVersions, parsed)
+	}
+
 	artifactsManager, err := artifacts.NewManager(logger, artifacts.Options{
 		MinVersion:                  minVersion,
+		BrokenVersions:              brokenVersions,
 		ImageRegistry:               opts.Artifacts.Core.Registry,
 		InsecureImageRegistry:       opts.Artifacts.Core.Insecure,
 		ImageVerifyOptions:          imageVerifyOptions,

cmd/image-factory/flags/config.go

@@ -5,6 +5,7 @@
 package flags
 
 import (
+	stdjson "encoding/json"
 	"errors"
 	"fmt"
 	"path/filepath"
@@ -116,7 +117,35 @@ func splitProvider(s string) (string, string) {
 
 func newEnvConfig(prefix string) Config {
 	return Config{
-		Provider: env.Provider(".", env.Opt{Prefix: prefix}),
+		Provider: env.Provider(".", env.Opt{
+			Prefix:        prefix,
+			TransformFunc: envTransform(prefix),
+		}),
+	}
+}
+
+// envTransform maps a prefixed environment variable to a koanf-style dotted, lower-cased key,
+// and JSON-decodes values that look like a JSON array or object so that complex types
+// (e.g. []string, []struct{...}) can be set from a single environment variable.
+//
+// Examples:
+//   - IF_HTTP_EXTERNALURL=https://x         → http.externalurl = "https://x"
+//   - IF_HTTP_ALLOWEDORIGINS=["*","foo"]    → http.allowedorigins = []any{"*","foo"}
+//   - IF_BUILD_BROKENTALOSVERSIONS=[{...}]  → build.brokentalosversions = []any{map[...]}
+func envTransform(prefix string) func(k, v string) (string, any) {
+	return func(k, v string) (string, any) {
+		key := strings.ToLower(strings.ReplaceAll(strings.TrimPrefix(k, prefix), "_", "."))
+
+		trimmed := strings.TrimSpace(v)
+		if trimmed != "" && (trimmed[0] == '[' || trimmed[0] == '{') {
+			var parsed any
+
+			if err := stdjson.Unmarshal([]byte(trimmed), &parsed); err == nil {
+				return key, parsed
+			}
+		}
+
+		return key, v
 	}
 }
 

docs/configuration.md

@@ -99,6 +99,16 @@ MinTalosVersion specifies the minimum supported Talos version for assets.
 
 ---
 
+### `build.brokenTalosVersions`
+
+- **Type:** `[]string`
+- **Env:** `BUILD_BROKENTALOSVERSIONS`
+
+BrokenTalosVersions lists Talos versions that should be considered broken and avoided when building assets.
+Those are versions that are known to have critical issues that prevent them from working correctly, such as bugs in Talos that cause build failures or runtime errors.
+
+---
+
 ### `build.maxConcurrency`
 
 - **Type:** `int`
@@ -1045,6 +1055,7 @@ authentication:
     enabled: false
     htpasswdPath: ""
 build:
+    brokenTalosVersions: []
     maxConcurrency: 6
     minTalosVersion: 1.2.0
 cache:
@@ -1156,6 +1167,7 @@ IF_ARTIFACTS_SCHEMATIC_REPOSITORY=schematics
 IF_ARTIFACTS_TALOSVERSIONRECHECKINTERVAL=15m0s
 IF_AUTHENTICATION_ENABLED=false
 IF_AUTHENTICATION_HTPASSWDPATH=
+IF_BUILD_BROKENTALOSVERSIONS=[]
 IF_BUILD_MAXCONCURRENCY=6
 IF_BUILD_MINTALOSVERSION=1.2.0
 IF_CACHE_CDN_ENABLED=false
@@ -1197,7 +1209,7 @@ IF_ENTERPRISE_VEX_DATA_INSECURE=false
 IF_ENTERPRISE_VEX_DATA_NAMESPACE=siderolabs/talos-vex
 IF_ENTERPRISE_VEX_DATA_REGISTRY=ghcr.io
 IF_ENTERPRISE_VEX_DATA_REPOSITORY=talos-vex-data
-IF_HTTP_ALLOWEDORIGINS=[*]
+IF_HTTP_ALLOWEDORIGINS=["*"]
 IF_HTTP_CERTFILE=
 IF_HTTP_EXTERNALPXEURL=
 IF_HTTP_EXTERNALURL=https://localhost/

hack/dev/config.yaml

@@ -15,6 +15,7 @@ artifacts:
     internal:
       registry: registry.local:5000
       namespace: siderolabs
+
 cache:
   oci:
     # private registry repository for cached assets

internal/artifacts/artifacts.go

@@ -24,6 +24,8 @@ type Options struct { //nolint:govet
 	InsecureImageRegistry bool
 	// MinVersion is the minimum version of Talos to use.
 	MinVersion semver.Version
+	// BrokenVersions are Talos versions that should be rejected when listing available versions.
+	BrokenVersions []semver.Version
 	// ImageVerifyOptions are the options for verifying the image signature.
 	ImageVerifyOptions ImageVerifyOptions
 	// TalosVersionRecheckInterval is the interval for rechecking Talos versions.

internal/artifacts/manager.go

@@ -165,6 +165,11 @@ func (m *Manager) Get(ctx context.Context, versionString string, arch Arch, kind
 	return path, nil
 }
 
+// GetBrokenTalosVersions returns the list of Talos versions marked as broken in the configuration.
+func (m *Manager) GetBrokenTalosVersions() []semver.Version {
+	return slices.Clone(m.options.BrokenVersions)
+}
+
 // GetTalosVersions returns a list of Talos versions available.
 func (m *Manager) GetTalosVersions(ctx context.Context) ([]semver.Version, error) {
 	m.talosVersionsMu.Lock()

internal/artifacts/versions.go

@@ -55,6 +55,10 @@ func (m *Manager) fetchTalosVersions() (any, error) {
 			return false // ignore versions below minimum
 		}
 
+		if slices.ContainsFunc(m.options.BrokenVersions, version.EQ) {
+			return false // ignore versions marked as broken
+		}
+
 		if len(version.Pre) > 0 {
 			if version.Major != maxVersion.Major || version.Minor != maxVersion.Minor {
 				return false // ignore pre-releases for older versions

internal/frontend/http/meta.go

@@ -21,7 +21,15 @@ import (
 )
 
 // handleVersions handles list of Talos versions available.
-func (f *Frontend) handleVersions(ctx context.Context, w http.ResponseWriter, _ *http.Request, _ httprouter.Params) error {
+func (f *Frontend) handleVersions(ctx context.Context, w http.ResponseWriter, r *http.Request, _ httprouter.Params) error {
+	if r.URL.Query().Get("broken") == "true" {
+		return json.NewEncoder(w).Encode(
+			xslices.Map(f.artifactsManager.GetBrokenTalosVersions(), func(v semver.Version) string {
+				return "v" + v.String()
+			}),
+		)
+	}
+
 	versions, err := f.artifactsManager.GetTalosVersions(ctx)
 	if err != nil {
 		return err

internal/integration/broken_versions_test.go

@@ -0,0 +1,46 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+//go:build integration
+
+package integration_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/image-factory/cmd/image-factory/cmd"
+	"github.com/siderolabs/image-factory/pkg/client"
+)
+
+// TestBrokenVersions verifies that versions listed in BrokenTalosVersions are
+// excluded from the /versions response and reported by /versions?broken=true.
+func TestBrokenVersions(t *testing.T) {
+	t.Parallel()
+
+	const brokenVersion = "v1.13.1"
+
+	options := cmd.DefaultOptions
+	options.Cache.OCI = cacheRepository.OCIRepositoryOptions
+	options.Metrics.Namespace = "test_broken_versions"
+	options.Build.BrokenTalosVersions = []string{brokenVersion[1:]}
+
+	ctx, listenAddr, _ := setupFactory(t, options)
+	baseURL := "http://" + listenAddr
+
+	c, err := client.New(baseURL, clientAuthCredentials()...)
+	require.NoError(t, err)
+
+	broken, err := c.BrokenVersions(ctx)
+	require.NoError(t, err)
+
+	assert.Contains(t, broken, brokenVersion)
+
+	versions, err := c.Versions(ctx)
+	require.NoError(t, err)
+
+	assert.NotContains(t, versions, brokenVersion)
+}