Skip to content

docs: update the SecureBoot imager output for v1.14 and v1.15 #937

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Iheanacho-ai wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: update the SecureBoot imager output for v1.14 and v1.15 #937

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 48 additions & 19 deletions ...talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@

> Note: There is no support at the moment to upgrade non-UKI (GRUB-based) Talos installation to use UKI/SecureBoot, so a fresh installation is required.

## SecureBoot with Sidero Labs images

Check warning on line 87 in public/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/sentence-case 

heading should be sentence case; lowercase "Labs" (or add it to exceptions.txt if it's a proper noun)

[Sidero Labs](https://www.siderolabs.com/) provides Talos images signed with the [Sidero Labs SecureBoot key](https://factory.talos.dev/secureboot/signing-cert.pem) via [Image Factory](../../learn-more/image-factory).

Expand Down Expand Up @@ -121,8 +121,13 @@

Once Talos is running in maintenance mode, verify that secure boot is enabled:

```shell
$ talosctl -n <IP> get securitystate --insecure
```bash
talosctl -n <IP> get securitystate --insecure
```

The output is similar to the following:

```text
NODE NAMESPACE TYPE ID VERSION SECUREBOOT
runtime SecurityState securitystate 1 true
```
Expand Down Expand Up @@ -211,11 +216,11 @@

**Note:** The `.pcrsig` section is **not measured** into any PCR, as it contains the signatures for the measurement results themselves.

#### systemd-boot Measurements

Check warning on line 219 in public/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/sentence-case 

heading should be sentence case; lowercase "Measurements" (or add it to exceptions.txt if it's a proper noun)

The [systemd-boot bootloader](https://www.freedesktop.org/software/systemd/man/latest/systemd-boot.html) can optionally measure loaded boot entries and configuration, though this is typically not used in Talos UKI scenarios since the UKI can be loaded directly.

#### Talos Boot phase measurements (PCR 11)

Check warning on line 223 in public/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/sentence-case 

heading should be sentence case; lowercase "Boot" (or add it to exceptions.txt if it's a proper noun)

In addition to the UKI section measurements, Talos extends **PCR 11** with its own boot phases to track the operating system initialization:

Expand All @@ -236,7 +241,7 @@

This ensures that disk decryption only occurs after the trusted boot chain has been verified, but before any potentially untrusted user workloads start.

#### Configurable PCR binding (Default: PCR 7)

Check warning on line 244 in public/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/sentence-case 

heading should be sentence case; lowercase "Default" (or add it to exceptions.txt if it's a proper noun)

By default, new Talos installations and upgrades maintain binding to **PCR 7**, which includes:

Expand Down Expand Up @@ -351,7 +356,7 @@

## SecureBoot with custom keys

### Generating the keys

Check warning on line 359 in public/talos/v1.14/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/stacked 

heading directly follows the heading on line 357; add at least one sentence between them

Talos requires two set of keys to be used for the SecureBoot process:

Expand All @@ -362,8 +367,13 @@

Talos provides a utility to generate the keys, but existing PKI can be used as well:

```shell
$ talosctl gen secureboot uki --common-name "SecureBoot Key"
```bash
talosctl gen secureboot uki --common-name "SecureBoot Key"
```

The output is similar to the following:

```text
writing _out/uki-signing-cert.pem
writing _out/uki-signing-cert.der
writing _out/uki-signing-key.pem
Expand All @@ -374,17 +384,27 @@

PCR signing key can be generated with:

```shell
$ talosctl gen secureboot pcr
```bash
talosctl gen secureboot pcr
```

The output is similar to the following:

```text
writing _out/pcr-signing-key.pem
```

The file containing the private key is written to disk in PEM-encoded format (RSA 2048-bit key).

Optionally, UEFI automatic key enrollment database can be generated using the `_out/uki-signing-*` files as input:

```shell
$ talosctl gen secureboot database
```bash
talosctl gen secureboot database
```

The output is similar to the following:

```text
writing _out/db.auth
writing _out/KEK.auth
writing _out/PK.auth
Expand All @@ -402,10 +422,12 @@
<CodeBlock lang="sh">
{`
$ docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_14} secureboot-iso
skipped pulling overlay (no overlay)
profile ready:
arch: amd64
platform: metal
secureboot: true
name: Talos
version: ${release_v1_14}
input:
kernel:
Expand All @@ -417,20 +439,24 @@
sdBoot:
path: /usr/install/amd64/systemd-boot.efi
baseInstaller:
imageRef: ghcr.io/siderolabs/installer-base:v1.5.0-alpha.3-35-ge0f383598-dirty
imageRef: ghcr.io/siderolabs/installer-base:${release_v1_14}
secureboot:
signingKeyPath: /secureboot/uki-signing-key.pem
signingCertPath: /secureboot/uki-signing-cert.pem
pcrSigningKeyPath: /secureboot/pcr-signing-key.pem
pcrPublicKeyPath: /secureboot/pcr-signing-public-key.pem
secureBootSigner:
keyPath: /secureboot/uki-signing-key.pem
certPath: /secureboot/uki-signing-cert.pem
pcrSigner:
keyPath: /secureboot/pcr-signing-key.pem
platformKeyPath: /secureboot/PK.auth
keyExchangeKeyPath: /secureboot/KEK.auth
signatureKeyPath: /secureboot/db.auth
output:
kind: iso
isoOptions:
sdBootEnrollKeys: if-safe
bootloader: sd-boot
outFormat: raw
skipped initramfs rebuild (no system extensions)
kernel command line: talos.platform=metal console=tty0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on lockdown=confidentiality
kernel command line: talos.platform=metal console=tty0 talos.halt_if_installed=1 slab_nomerge pti=on consoleblank=0 printk.devkmsg=on selinux=1 module.sig_enforce=1 proc_mem.force_override=never
UKI ready
ISO ready
output asset path: /out/metal-amd64-secureboot.iso
Expand All @@ -442,10 +468,12 @@
<CodeBlock lang="sh">
{`
$ docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_14} secureboot-installer
skipped pulling overlay (no overlay)
profile ready:
arch: amd64
platform: metal
secureboot: true
name: Talos
version: ${release_v1_14}
input:
kernel:
Expand All @@ -459,18 +487,19 @@
baseInstaller:
imageRef: ghcr.io/siderolabs/installer-base:${release_v1_14}
secureboot:
signingKeyPath: /secureboot/uki-signing-key.pem
signingCertPath: /secureboot/uki-signing-cert.pem
pcrSigningKeyPath: /secureboot/pcr-signing-key.pem
pcrPublicKeyPath: /secureboot/pcr-signing-public-key.pem
secureBootSigner:
keyPath: /secureboot/uki-signing-key.pem
certPath: /secureboot/uki-signing-cert.pem
pcrSigner:
keyPath: /secureboot/pcr-signing-key.pem
platformKeyPath: /secureboot/PK.auth
keyExchangeKeyPath: /secureboot/KEK.auth
signatureKeyPath: /secureboot/db.auth
output:
kind: installer
outFormat: raw
skipped initramfs rebuild (no system extensions)
kernel command line: talos.platform=metal console=tty0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on lockdown=confidentiality
kernel command line: talos.platform=metal console=tty0 slab_nomerge pti=on consoleblank=0 printk.devkmsg=on selinux=1 module.sig_enforce=1 proc_mem.force_override=never
UKI ready
installer container image ready
output asset path: /out/installer-amd64-secureboot.tar
Expand Down
67 changes: 48 additions & 19 deletions ...talos/v1.15/platform-specific-installations/bare-metal-platforms/secureboot.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@

> Note: There is no support at the moment to upgrade non-UKI (GRUB-based) Talos installation to use UKI/SecureBoot, so a fresh installation is required.

## SecureBoot with Sidero Labs images

Check warning on line 87 in public/talos/v1.15/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/sentence-case 

heading should be sentence case; lowercase "Labs" (or add it to exceptions.txt if it's a proper noun)

[Sidero Labs](https://www.siderolabs.com/) provides Talos images signed with the [Sidero Labs SecureBoot key](https://factory.talos.dev/secureboot/signing-cert.pem) via [Image Factory](../../learn-more/image-factory).

Expand Down Expand Up @@ -121,8 +121,13 @@

Once Talos is running in maintenance mode, verify that secure boot is enabled:

```shell
$ talosctl -n <IP> get securitystate --insecure
```bash
talosctl -n <IP> get securitystate --insecure
```

The output is similar to the following:

```text
NODE NAMESPACE TYPE ID VERSION SECUREBOOT
runtime SecurityState securitystate 1 true
```
Expand Down Expand Up @@ -211,11 +216,11 @@

**Note:** The `.pcrsig` section is **not measured** into any PCR, as it contains the signatures for the measurement results themselves.

#### systemd-boot Measurements

Check warning on line 219 in public/talos/v1.15/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/sentence-case 

heading should be sentence case; lowercase "Measurements" (or add it to exceptions.txt if it's a proper noun)

The [systemd-boot bootloader](https://www.freedesktop.org/software/systemd/man/latest/systemd-boot.html) can optionally measure loaded boot entries and configuration, though this is typically not used in Talos UKI scenarios since the UKI can be loaded directly.

#### Talos Boot phase measurements (PCR 11)

Check warning on line 223 in public/talos/v1.15/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/sentence-case 

heading should be sentence case; lowercase "Boot" (or add it to exceptions.txt if it's a proper noun)

In addition to the UKI section measurements, Talos extends **PCR 11** with its own boot phases to track the operating system initialization:

Expand All @@ -236,7 +241,7 @@

This ensures that disk decryption only occurs after the trusted boot chain has been verified, but before any potentially untrusted user workloads start.

#### Configurable PCR binding (Default: PCR 7)

Check warning on line 244 in public/talos/v1.15/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/sentence-case 

heading should be sentence case; lowercase "Default" (or add it to exceptions.txt if it's a proper noun)

By default, new Talos installations and upgrades maintain binding to **PCR 7**, which includes:

Expand Down Expand Up @@ -351,7 +356,7 @@

## SecureBoot with custom keys

### Generating the keys

Check warning on line 359 in public/talos/v1.15/platform-specific-installations/bare-metal-platforms/secureboot.mdx

View workflow job for this annotation

GitHub Actions / docs-checks

headings/stacked 

heading directly follows the heading on line 357; add at least one sentence between them

Talos requires two set of keys to be used for the SecureBoot process:

Expand All @@ -362,8 +367,13 @@

Talos provides a utility to generate the keys, but existing PKI can be used as well:

```shell
$ talosctl gen secureboot uki --common-name "SecureBoot Key"
```bash
talosctl gen secureboot uki --common-name "SecureBoot Key"
```

The output is similar to the following:

```text
writing _out/uki-signing-cert.pem
writing _out/uki-signing-cert.der
writing _out/uki-signing-key.pem
Expand All @@ -374,17 +384,27 @@

PCR signing key can be generated with:

```shell
$ talosctl gen secureboot pcr
```bash
talosctl gen secureboot pcr
```

The output is similar to the following:

```text
writing _out/pcr-signing-key.pem
```

The file containing the private key is written to disk in PEM-encoded format (RSA 2048-bit key).

Optionally, UEFI automatic key enrollment database can be generated using the `_out/uki-signing-*` files as input:

```shell
$ talosctl gen secureboot database
```bash
talosctl gen secureboot database
```

The output is similar to the following:

```text
writing _out/db.auth
writing _out/KEK.auth
writing _out/PK.auth
Expand All @@ -402,10 +422,12 @@
<CodeBlock lang="sh">
{`
$ docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_15} secureboot-iso
skipped pulling overlay (no overlay)
profile ready:
arch: amd64
platform: metal
secureboot: true
name: Talos
version: ${release_v1_15}
input:
kernel:
Expand All @@ -417,20 +439,24 @@
sdBoot:
path: /usr/install/amd64/systemd-boot.efi
baseInstaller:
imageRef: ghcr.io/siderolabs/installer-base:v1.5.0-alpha.3-35-ge0f383598-dirty
imageRef: ghcr.io/siderolabs/installer-base:${release_v1_15}
secureboot:
signingKeyPath: /secureboot/uki-signing-key.pem
signingCertPath: /secureboot/uki-signing-cert.pem
pcrSigningKeyPath: /secureboot/pcr-signing-key.pem
pcrPublicKeyPath: /secureboot/pcr-signing-public-key.pem
secureBootSigner:
keyPath: /secureboot/uki-signing-key.pem
certPath: /secureboot/uki-signing-cert.pem
pcrSigner:
keyPath: /secureboot/pcr-signing-key.pem
platformKeyPath: /secureboot/PK.auth
keyExchangeKeyPath: /secureboot/KEK.auth
signatureKeyPath: /secureboot/db.auth
output:
kind: iso
isoOptions:
sdBootEnrollKeys: if-safe
bootloader: sd-boot
outFormat: raw
skipped initramfs rebuild (no system extensions)
kernel command line: talos.platform=metal console=tty0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on lockdown=confidentiality
kernel command line: talos.platform=metal console=tty0 talos.halt_if_installed=1 slab_nomerge pti=on consoleblank=0 printk.devkmsg=on selinux=1 module.sig_enforce=1 proc_mem.force_override=never
UKI ready
ISO ready
output asset path: /out/metal-amd64-secureboot.iso
Expand All @@ -442,10 +468,12 @@
<CodeBlock lang="sh">
{`
$ docker run --rm -t -v $PWD/_out:/secureboot:ro -v $PWD/_out:/out ghcr.io/siderolabs/imager:${release_v1_15} secureboot-installer
skipped pulling overlay (no overlay)
profile ready:
arch: amd64
platform: metal
secureboot: true
name: Talos
version: ${release_v1_15}
input:
kernel:
Expand All @@ -459,18 +487,19 @@
baseInstaller:
imageRef: ghcr.io/siderolabs/installer-base:${release_v1_15}
secureboot:
signingKeyPath: /secureboot/uki-signing-key.pem
signingCertPath: /secureboot/uki-signing-cert.pem
pcrSigningKeyPath: /secureboot/pcr-signing-key.pem
pcrPublicKeyPath: /secureboot/pcr-signing-public-key.pem
secureBootSigner:
keyPath: /secureboot/uki-signing-key.pem
certPath: /secureboot/uki-signing-cert.pem
pcrSigner:
keyPath: /secureboot/pcr-signing-key.pem
platformKeyPath: /secureboot/PK.auth
keyExchangeKeyPath: /secureboot/KEK.auth
signatureKeyPath: /secureboot/db.auth
output:
kind: installer
outFormat: raw
skipped initramfs rebuild (no system extensions)
kernel command line: talos.platform=metal console=tty0 init_on_alloc=1 slab_nomerge pti=on consoleblank=0 nvme_core.io_timeout=4294967295 printk.devkmsg=on lockdown=confidentiality
kernel command line: talos.platform=metal console=tty0 slab_nomerge pti=on consoleblank=0 printk.devkmsg=on selinux=1 module.sig_enforce=1 proc_mem.force_override=never
UKI ready
installer container image ready
output asset path: /out/installer-amd64-secureboot.tar
Expand Down
Loading