feat: add config embedding

docs/api.md

@@ -65,6 +65,16 @@ customization:
        # optional, include well-known UEFI certificates into auto-enrollment database (SecureBoot ISO only)
       includeWellKnownCertificates: true
     bootloader: sd-boot # optional, defaults to auto (bootloader chosen by imager), other options: dual-boot, grub
+    embeddedMachineConfiguration: | # optional, embedded machine configuration (YAML-encoded)
+      apiVersion: v1alpha1
+      kind: HostnameConfig
+      hostname: my-custom-hostname
+      auto: off
+      ---
+      apiVersion: v1alpha1
+      kind: KmsgLogConfig
+      name: remote-log
+      url: tcp://10.0.0.50:5044/
 overlay: # optional
   image: ghcr.io/siderolabs/sbc-raspberry-pi # overlay image
   name: rpi_generic # overlay name

go.sum

@@ -1550,8 +1550,6 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
 golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1646,10 +1644,6 @@ golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
 golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
 golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1767,15 +1761,11 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
 golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1790,8 +1780,6 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

hack/release.toml

@@ -10,6 +10,12 @@ pre_release = false
 
 [notes]
 
+    [notes.scanner]
+        title = "Machine configuration embedding"
+        description = """\
+Image Factory now supports embedding machine configuration into generated images starting with Talos version 1.2.0 onwards.
+"""
+
 [make_deps]
 
     [make_deps.pkgs]

internal/frontend/http/locales/active.en.yaml

@@ -184,6 +184,18 @@
 - id: customization.overlay.skip
   translation: "If unsure, you can skip this step."
 
+- id: customization.embedded_config
+  translation: "Embedded machine configuration:"
+
+- id: customization.embedded_config.description
+  translation: "This configuration will be embedded into the image. For more details see the  "
+
+- id: customization.embedded_config.reference
+  translation: "documentation"
+
+- id: customization.embedded_config.skip
+  translation: "Skip this step if unsure."
+
 - id: customization.bootloader.title
   translation: "Bootloader"
 

internal/frontend/http/locales/active.fr.yaml

@@ -184,6 +184,18 @@
 - id: customization.overlay.skip
   translation: "En cas de doute, vous pouvez ignorer cette étape."
 
+- id: customization.embedded_config
+  translation: "Configuration machine intégrée :"
+
+- id: customization.embedded_config.description
+  translation: "Cette configuration sera intégrée à l'image. Pour plus de détails, consultez la "
+
+- id: customization.embedded_config.reference
+  translation: "documentation"
+
+- id: customization.embedded_config.skip
+  translation: "Ignorez cette étape en cas de doute."
+
 - id: customization.bootloader.title
   translation: "Chargeur d'amorçage"
 

internal/frontend/http/locales/active.pl.yaml

@@ -184,6 +184,18 @@
 - id: customization.overlay.skip
   translation: "Jeśli nie masz pewności - możesz pominąć ten krok."
 
+- id: customization.embedded_config
+  translation: "Wbudowana konfiguracja maszyny:"
+
+- id: customization.embedded_config.description
+  translation: "Ta konfiguracja zostanie wbudowana w obraz. Aby uzyskać więcej informacji, zobacz "
+
+- id: customization.embedded_config.reference
+  translation: "dokumentację"
+
+- id: customization.embedded_config.skip
+  translation: "Pomiń ten krok, jeśli nie masz pewności."
+
 - id: customization.bootloader.title
   translation: "Program rozruchowy"
 

internal/frontend/http/locales/active.ru.yaml

@@ -184,6 +184,18 @@
 - id: customization.overlay.skip
   translation: "Если не уверены — можно пропустить."
 
+- id: customization.embedded_config
+  translation: "Встроенная конфигурация машины:"
+
+- id: customization.embedded_config.description
+  translation: "Эта конфигурация будет встроена в образ. Подробнее см. в "
+
+- id: customization.embedded_config.reference
+  translation: "документации"
+
+- id: customization.embedded_config.skip
+  translation: "Пропустите этот шаг, если не уверены."
+
 - id: customization.bootloader.auto.name
   translation: "Авто"
 

internal/frontend/http/templates/common.html

@@ -98,6 +98,8 @@ <h1 class="mb-4 mt-2 text-2xl font-bold">{{ . }}</h1>
 <input type="hidden" name="selected-bootloader" value="{{ .Bootloader }}">
 <input type="hidden" name="overlay-options" value="{{ .OverlayOptions }}">
 <input type="hidden" name="selected-overlay-options" value="{{ .OverlayOptions }}">
+<input type="hidden" name="embedded-config" value="{{ .EmbeddedConfig }}">
+<input type="hidden" name="selected-embedded-config" value="{{ .EmbeddedConfig }}">
 {{- end -}}
 {{ end }}
 
@@ -107,7 +109,7 @@ <h1 class="mb-4 mt-2 text-2xl font-bold">{{ . }}</h1>
     href="https://docs.siderolabs.com/talos/{{ short_version .Version }}{{ .Platform.Documentation}}">{{ t .Localizer
     "common.documentation" }}</a>).
 {{ end }}
-
+        
 {{ define "board-description" }}
 {{ t .Localizer "common.runs_on" }} {{ .Board.Label }}{{ if .Board.Documentation }} (<a target="_blank"
     class="text-blue-600 dark:text-blue-500 underline"

internal/frontend/http/templates/wizard-cmdline.html

@@ -12,7 +12,7 @@
         <input name="cmdline-set" type="hidden" value="1">
     </div>
 
-    <div class="ms-2 prose dark:prose-invert prose-sm">
+    <div class="ms-2 prose dark:prose-invert prose-sm mb-6">
         <p>
             {{ t .Localizer "customization.cmdline.description" }}<a target="_blank"
                 href="https://docs.siderolabs.com/talos/{{ short_version .Version }}/reference/kernel/">{{ t .Localizer
@@ -37,6 +37,30 @@
         </p>
     </div>
 
+    {{ if .EmbeddedConfigEnabled }}
+    <div class="mb-6">
+        <label for="embedded-config" class="block mb-2 text-sm font-medium text-gray-900 dark:text-white">
+            {{ t .Localizer "customization.embedded_config" }}
+        </label>
+        <textarea id="embedded-config" name="embedded-config"
+            class="bg-gray-50 border min-h-24 border-gray-300 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full h-16 p-2.5 dark:bg-gray-700 dark:border-gray-600 dark:placeholder-gray-400 dark:text-white dark:focus:ring-blue-500 dark:focus:border-blue-500"
+            placeholder="apiVersion: v1alpha1
+kind: HostnameConfig
+hostname: my-custom-hostname
+auto: off">{{ .SelectedEmbeddedConfig }}</textarea>
+    </div>
+
+    <div class="ms-2 prose dark:prose-invert prose-sm mb-6">
+        <p>
+            {{ t .Localizer "customization.embedded_config.description" }}<a target="_blank"
+                href="https://docs.siderolabs.com/talos/{{ short_version .Version }}/configure-your-talos-cluster/system-configuration/acquire#embedded-configuration"> {{ t .Localizer "customization.embedded_config.reference" }}</a>.
+        </p>
+        <p>
+            {{ t .Localizer "customization.embedded_config.skip" }}
+        </p>
+    </div>
+    {{ end }}
+
     {{ if .OverlayOptionsEnabled }}
     <div class="mb-6 mt-6">
         <label for="extra-overlay-options" class="block mb-2 text-sm font-medium text-gray-900 dark:text-white">

internal/frontend/http/templates/wizard-final.html

@@ -382,7 +382,7 @@ <h2>{{ t .Localizer "final.extra.vex" }}</h2>
 
 <div class="flex gap-4">
         {{ template "back-button" (dict "Params"
-        "target,version,platform,board,arch,secureboot,extensions,selected-bootloader,selected-cmdline,selected-overlay-options"
+        "target,version,platform,board,arch,secureboot,extensions,selected-bootloader,selected-cmdline,selected-overlay-options,selected-embedded-config"
         "Localizer" .Localizer) }}
 </div>
 {{ end }}

internal/frontend/http/ui.go

@@ -210,6 +210,7 @@ type WizardParams struct { //nolint:govet
 	Extensions     []string
 	Cmdline        string
 	CmdlineSet     bool
+	EmbeddedConfig string
 	OverlayOptions string
 
 	SelectedTarget         string
@@ -221,6 +222,7 @@ type WizardParams struct { //nolint:govet
 	SelectedBootloader     string
 	SelectedExtensions     []string
 	SelectedCmdline        string
+	SelectedEmbeddedConfig string
 	SelectedOverlayOptions string
 
 	// Dynamically set fields.
@@ -251,6 +253,10 @@ func SetURLValuesFromSchematic(params *WizardParams, s *schematic.Schematic) {
 		params.Extensions = []string{"-"}
 	}
 
+	if s.Customization.EmbeddedMachineConfiguration != "" {
+		params.EmbeddedConfig = s.Customization.EmbeddedMachineConfiguration
+	}
+
 	if s.Overlay.Name != "" || s.Overlay.Image != "" || len(s.Overlay.Options) > 0 {
 		params.Target = TargetSBC
 		params.BoardMeta = platforms.SBC{
@@ -382,6 +388,7 @@ func WizardParamsFromRequest(r *http.Request) WizardParams {
 		Extensions:     r.Form["extensions"],
 		Cmdline:        strings.TrimSpace(r.FormValue("cmdline")),
 		CmdlineSet:     r.FormValue("cmdline-set") != "",
+		EmbeddedConfig: r.FormValue("embedded-config"),
 		OverlayOptions: strings.TrimSpace(r.FormValue("overlay-options")),
 
 		SelectedTarget:         r.FormValue("selected-target"),
@@ -393,6 +400,7 @@ func WizardParamsFromRequest(r *http.Request) WizardParams {
 		SelectedBootloader:     r.FormValue("selected-bootloader"),
 		SelectedExtensions:     r.Form["selected-extensions"],
 		SelectedCmdline:        r.FormValue("selected-cmdline"),
+		SelectedEmbeddedConfig: r.FormValue("selected-embedded-config"),
 		SelectedOverlayOptions: r.FormValue("selected-overlay-options"),
 	}
 
@@ -493,6 +501,8 @@ func (p WizardParams) URLValues() url.Values {
 		values.Set("cmdline-set", "true")
 	}
 
+	// Skip adding the embedded config to url avalues to avoid exposing secrets through the url and browser history.
+
 	if p.OverlayOptions != "" {
 		values.Set("overlay-options", p.OverlayOptions)
 	}
@@ -636,10 +646,12 @@ func (f *Frontend) wizardCmdline(_ context.Context, params WizardParams) (string
 
 			OverlayOptionsEnabled       bool
 			SupportsBootloaderSelection bool
+			EmbeddedConfigEnabled       bool
 		}{
 			WizardParams: params,
 
 			OverlayOptionsEnabled:       params.Target == TargetSBC && quirks.New(params.Version).SupportsOverlay(),
+			EmbeddedConfigEnabled:       quirks.New(params.Version).SupportsEmbeddedConfig(),
 			SupportsBootloaderSelection: talosVersion.GTE(semver.MustParse("1.12.0-alpha.2")),
 		},
 		params.URLValues(),
@@ -663,6 +675,10 @@ func (f *Frontend) wizardFinal(ctx context.Context, params WizardParams) (string
 		return "", nil, nil, err
 	}
 
+	if params.EmbeddedConfig != "" {
+		requestedSchematic.Customization.EmbeddedMachineConfiguration = params.EmbeddedConfig
+	}
+
 	schematicID, err := f.schematicFactory.Put(ctx, &requestedSchematic)
 	if err != nil {
 		return "", nil, nil, err

internal/frontend/http/ui_test.go

@@ -15,6 +15,8 @@ import (
 	"github.com/siderolabs/image-factory/internal/frontend/http"
 )
 
+const testEmbdeddedMachineConfiguration = "apiVersion: v1alpha1/nkind: HostnameConfig/nhostname: my-custom-hostname/nauto: off"
+
 func TestSetValuesFromSchematic(t *testing.T) {
 	ctx := t.Context()
 
@@ -33,7 +35,8 @@ func TestSetValuesFromSchematic(t *testing.T) {
 			"siderolabs/iscsi-tools",
 			"-",
 		},
-		Bootloader: "grub",
+		Bootloader:     "grub",
+		EmbeddedConfig: testEmbdeddedMachineConfiguration,
 	}
 
 	s, err := input.ToSchematic(ctx, nil)
@@ -69,3 +72,14 @@ func TestSetValuesFromSchematic(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, s, s2)
 }
+
+func TestURLValuesOmitsEmbeddedConfig(t *testing.T) {
+	values := http.WizardParams{
+		Cmdline:        "console=tty0",
+		EmbeddedConfig: testEmbdeddedMachineConfiguration,
+		Version:        "v1.13.2",
+	}.URLValues()
+
+	assert.Equal(t, "console=tty0", values.Get("cmdline"))
+	assert.NotContains(t, values, "embedded-config")
+}