Skip to content

docs: add the On Premises token actor profile #934

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Iheanacho-ai wants to merge 1 commit into
base: main
Choose a base branch
from
+3 −1
Open

docs: add the On Premises token actor profile #934

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion public/talos-enterprise-linux/learn-more/api-tokens.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,16 @@

A token that is valid but carries no scope for the requested route does not authenticate the request.

The web UI does not expose individual scopes. It offers four fixed actor profiles, each carrying a predefined set.
The web UI does not expose individual scopes. It offers five fixed actor profiles, each carrying a predefined set.

### Token actor profiles

Choose a profile when creating a token in the web UI. The profile determines the full set of scopes that the token carries, and it cannot be changed after creation.

- **Talos:** This profile carries the `image:read` scope. It is intended for nodes that pull enterprise images. The scope allows access to generated image downloads, PXE scripts, and installer OCI pulls. It does not grant access to security reports or token management.

- **On Premises:** This profile carries the `source:pull` scope. It is intended for mirroring source images from Enterprise Image Factory into an on-premises installation. The scope allows read-only pulls under `/v2/siderolabs/` of the installer, installer base, and imager images, the extension and overlay manifests, `talosctl`, the Image Factory image, and the Talos Linux VEX data. It does not grant access to generated images, schematics, the security report endpoints, or token management.

Check notice on line 44 in public/talos-enterprise-linux/learn-more/api-tokens.mdx

View workflow job for this annotation

GitHub Actions / doc-accuracy

Doc accuracy — NOTICE 

Backticked `talosctl` may not be the actual mirrored repository name (upstream uses talosctl-all).
Why: Upstream docs/sources.md and hack/copy-artifacts.sh mirror siderolabs/talosctl-all, not siderolabs/talosctl; authentication.md does not enumerate the proxied repositories so this could not be fully confirmed. The sentence is descriptive only, so there is no consequence for a reader beyond a possibly wrong artifact name.
Fix: The scope allows read-only pulls under /v2/siderolabs/ of the installer, installer base, and imager images, the extension and overlay manifests, the talosctl-all CLI image, the Image Factory image, and the Talos Linux VEX data.

- **Automation (Omni / Terraform):** This profile carries the `image:read`, `report:read`, `schematic:create`, `schematic:read`, and `token:issue` scopes. It is intended for tooling that builds and consumes schematics. It allows the tooling to create and read schematics, pull images, read security reports, and issue bounded Talos or Automation tokens.

- **Operator:** This profile carries the `image:read`, `report:read`, `schematic:create`, `schematic:read`, and `source:pull` scopes. It is intended for a person or CI job working across the factory. In addition to access to images, schematics, and reports, it provides source proxy access. It cannot issue, list, or revoke tokens.
Expand Down
Loading