Talos
Omni
Kubernetes GuidesSome components of Talos Linux are distributed as part of the Talos operating system image (for example,Documentation Index
Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
Use this file to discover all available pages before exploring further.
containerd), while
others are pulled as container images from the registry (for example, ghcr.io/siderolabs/kubelet).
All workloads running in Kubernetes clusters created with Talos Linux are also running as container images.
Thus, verifying the signatures of the container images is an important part of the security of the cluster, in order to prevent supply chain attacks and ensure that the images have not been tampered with.
Talos Linux provides a machine-wide configurable image signature verification policy which covers all image pulls on the machine,
including the ones initiated by the Talos operating system itself, as well as the ones initiated by Kubernetes for the workloads running in the cluster.
The image signature verification policy is a top-down list of rules which are evaluated in order.
The first rule that matches the image being pulled is applied, and the rest of the rules are ignored.
The rules can be configured to verify the signature, ignore the signature, or reject the image.
A rule matches on the image reference without the tag or digest, e.g. for the image ghcr.io/siderolabs/installer:v1.13.0, the reference matched is ghcr.io/siderolabs/installer.
The policy is configured using the ImageVerificationConfig configuration document.
registry.k8s.io and requires them to be signed by the Kubernetes release engineering team service account,
while the second rule matches all images from ghcr.io/siderolabs and requires them to be signed by a Sidero Labs employee or the Talos production release manager service account.
For the images from factory.talos.dev (Image Factory), the third rule requires them to be signed by the Talos production image factory service account.
Any other images that do not match any of the rules will be allowed by default.
This example set of rules can be used as a starting point for the image signature verification policy, and it can be customized to fit the specific needs of the cluster and the organization.
These rules cover all images used by Talos Linux itself by default, so they can be used as a base policy for the cluster and then additional rules can be added for the workloads running in the cluster.
It is also possible to create a closed policy that rejects all images that do not match any of the rules by adding a final rule with deny: true:
skip: true can be added:
Note: Keyless verification will not work on air-gapped clusters that do not have access to the Internet.Public key verification does not have the above limitation, but it requires generating and managing the signing keys and making the public keys available to the Talos machines. The image verification policy is applied at the moment of pulling the image, so if the image is already present in the local image store, the signature will not be verified again. The signature verification can be verified by checking the image labels, for the presence of the
talos.dev/verified label: