Install and wire the containerd image verifier on every node #3335

Activity

1. github-project-automation

   added this to 🌊 Project Boardon Aug 23, 2026
2. devantler

   added the

   Security

   issue type on Aug 23, 2026
3. devantler

   added a parent issue on Aug 23, 2026

   • Establish that first-party image signature verification actually enforces on the fleet #3101
4. devantler

   marked this as blocked by 2 issues on Aug 23, 2026

   • Determine which supported Talos mechanism supplies the containerd image-verifier binary #3333
   • Sign or scope every first-party image that a verifier would refuse, before enforcement goes live #3334
5. devantler

   marked this as blocking on Aug 23, 2026

   • Prove an unsigned image is refused at pull, then activate the liveness check #3336
6. devantler

   moved this to 📥 Backlog in 🌊 Project Boardon Aug 23, 2026
7. devantler commented on Aug 24, 2026

   

   devantler

   on Aug 24, 2026

   ContributorAuthor

   More actions

   🤖 Generated by the Agentic Engineer

   Closing: there is no verifier to install, and this issue's acceptance criterion is unreachable

   The Spike this was blocked by — #3333 — is answered, and the answer removes this issue's subject
   rather than deciding its shape.

   Measured independently against admin@prod on 2026-08-24 (full evidence on #3333): image
   verification on Talos v1.13 is implemented by Talos itself, via
   security.ImageVerificationConfigController (which materialises the rules into phase: running
   resources on every node) and security.TUFTrustedRootController (which maintains a live Sigstore TUF
   trust root, version 6, refreshed 2026-08-22). The io.containerd.image-verifier.v1.bindir plugin is
   not the mechanism here: no bin_dir is configured in any file under /etc/cri/conf.d, yet the rules
   are demonstrably not inert.

   That makes this issue's central acceptance criterion —

   bin_dir is configured and the directory is non-empty on every node

   — not an unmet target but an unreachable one. It would stay false on a cluster that is verifying
   images perfectly, because nothing in the supported design ever populates it. Delivering this issue as
   written would mean building an external-binary delivery path (schematic or extension) that duplicates
   a subsystem Talos already runs, and then asserting a condition the platform does not produce.

   Nothing is lost by closing it. The two things this issue was really protecting are both still
   tracked:

   • Is enforcement actually effective, observed rather than inferred? → Prove an unsigned image is refused at pull, then activate the liveness check #3336, which is the
     genuine remaining work.
   • Does our liveness check reliably tell us so? → Liveness check can report OK for a disabled plugin or a stale node snapshot #3108, re-scoped in the same pass, because
     that script asserts the same refuted bin_dir condition and therefore reports a permanent false
     RED rather than a false OK.

   I have re-pointed #3336's dependency from this issue to #3108, so the chain stays intact.

   Closing as not planned — invalidated premise, not abandoned work.
8. devantler

   closed this as not plannedon Aug 24, 2026
9. github-project-automation

   moved this from 📥 Backlog to ✅ Done in 🌊 Project Boardon Aug 24, 2026
10. devantler

    unmarked this as blocking on Aug 24, 2026

    • Prove an unsigned image is refused at pull, then activate the liveness check #3336