http api for imager

[ghouscht]

Hey,
I'm working in an environment where we can't use the Talos recommended image factory, mainly due to:

• using a custom Talos build
• having custom secureboot keys (sitting in AWS KMS)
• having custom system extensions

So for us the only option is to use the imager Docker container to build Talos boot ISOs. However, using the imager in an "enterprise environment" can be a bit cumbersome, especially if you need to build a lot of ISOs in an automated way at a certain scale.

It would be beneficial if the imager could expose a simple http api were one could easily POST a yaml config to an endpoint which then would return the generated assets.

Did you ever think of something like that? Or do you have plans to extend the image factory to remove the constraints that prevent us from using it?

ps. I would be happy to help build such a feature in the imager or help change the image factory if there is a chance that such a feature/change would be accepted.

Thank you, Thomas

[smira]

Image Factory basically is an HTTP API for the imager. You can run your own with your own builds/extensions/whatever.

[ghouscht]

Ok, understood! As I worte above we're using AWS KMS to store our secureboot keys, the imager has the ability to retrive the keys through KMS (https://github.com/siderolabs/talos/blob/main/pkg/imager/profile/input.go#L122-L124). However, such a feature for example is missing in the image-factory (as far as I can see, documentation is a bit scarce). Is this something that is planned to add to the image-factory as well? ( I'm happy to help to get such a feature into the image-factory.)

[smira]

Yes, you should be able to add that with a simple PR - we just never did that as this wasn't required.

Actually we might need that soon, so it's a race who would do it first :)

[ghouscht]

siderolabs/image-factory#259

Is probably all we would need to switch to use image-factory. I can try to do an e2e test with AWS KMS on Monday.

[smira]

I will merge the PR so that it's easier to try, but we can fix things if something is missing, but it should work