From 24e4d00c05839429211ee43b39eba5a5e90dcc22 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Sun, 28 Dec 2025 22:37:50 -0800 Subject: [PATCH] security(hooks): suppress imager output to prevent secret leakage The Talos imager prints the full profile to stdout, which includes the embedded machine configuration containing certificates and private keys. This was being logged in CI, exposing sensitive cluster secrets. Fix: Redirect stdout to /dev/null while keeping stderr for errors. Also removed -t flag as TTY allocation is not needed in CI. --- images/hooks/talos-embed-config.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/images/hooks/talos-embed-config.sh b/images/hooks/talos-embed-config.sh index 625833e..27bd33b 100755 --- a/images/hooks/talos-embed-config.sh +++ b/images/hooks/talos-embed-config.sh @@ -135,12 +135,14 @@ embed_config() { # The imager creates a fresh ISO from scratch - it doesn't modify the downloaded ISO # Mount work dir to /out (imager's default output directory) # Note: --privileged is required for SELinux xattr operations on CI runners - docker run --rm -t --privileged \ + # IMPORTANT: Redirect stdout to /dev/null to prevent secrets from being logged + # The imager prints the full profile (including embedded config with certs/keys) to stdout + docker run --rm --privileged \ -v "${WORK_DIR}:/out" \ "ghcr.io/siderolabs/imager:${talos_version}" \ iso \ --arch amd64 \ - --embedded-config-path=/out/machine.yaml + --embedded-config-path=/out/machine.yaml > /dev/null # Find the generated ISO (imager outputs to /out/metal-amd64.iso) local output_iso="${WORK_DIR}/metal-amd64.iso"