feat: validate Talos extensions against the catalog

Extension names on installation media configs, machine request sets, and extensions configurations are now validated against the Talos extensions catalog for the relevant Talos version. Unknown names, duplicates, and oversized lists are rejected. When no Talos version is set, the default version's catalog is used so the names still get checked. Names without a namespace are looked up under siderolabs/ so older clients that send the documented short form keep working.

The omnictl installation media create command also resolves short or partial extension names to canonical form before sending, replacing the client-side catalog check it used to do.

Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>

Author: utkuozdemir

client/pkg/omnictl/installationmedia/create.go

@@ -121,27 +121,28 @@ func createPreset(ctx context.Context, cmd *cobra.Command, client *client.Client
 	// Strip a leading "v" so the value matches the canonical Talos version form.
 	talosVersion := strings.TrimPrefix(createCmdFlags.talosVersion, "v")
 
-	// An empty user value means "use the server's default at download time"; for create-time
-	// validation against platform min-versions and extension catalogs, fall back to the CLI's
-	// default Talos version so the checks still run.
-	validationTalosVersion := talosVersion
-	if validationTalosVersion == "" {
-		validationTalosVersion = constants.DefaultTalosVersion
+	bootloader, err := download.ParseBootloader(createCmdFlags.bootloader)
+	if err != nil {
+		return err
 	}
 
-	if err = download.ValidateTalosVersion(ctx, client.Omni().State(), validationTalosVersion); err != nil {
-		return err
+	// Resolve short or partial extension names to full catalog names. Falls back to the default
+	// Talos version when the user left it empty, since a concrete catalog is needed to look the
+	// names up. The server still validates the result.
+	resolveTalosVersion := talosVersion
+	if resolveTalosVersion == "" {
+		resolveTalosVersion = constants.DefaultTalosVersion
 	}
 
-	bootloader, err := download.ParseBootloader(createCmdFlags.bootloader)
+	resolvedExtensions, err := download.ResolveExtensions(ctx, client.Omni().State(), resolveTalosVersion, createCmdFlags.extensions)
 	if err != nil {
 		return err
 	}
 
 	spec := &specs.InstallationMediaConfigSpec{
 		TalosVersion:      talosVersion,
 		Architecture:      arch,
-		InstallExtensions: createCmdFlags.extensions,
+		InstallExtensions: resolvedExtensions,
 		KernelArgs:        strings.Join(createCmdFlags.extraKernelArgs, " "),
 		JoinToken:         tokenID,
 		SecureBoot:        createCmdFlags.secureBoot,
@@ -158,7 +159,7 @@ func createPreset(ctx context.Context, cmd *cobra.Command, client *client.Client
 	}
 
 	if createCmdFlags.platform != "" {
-		if err = download.ValidateCloudPlatform(ctx, client.Omni().State(), createCmdFlags.platform, arch, createCmdFlags.secureBoot, validationTalosVersion); err != nil {
+		if err = download.ValidateCloudPlatform(ctx, client.Omni().State(), createCmdFlags.platform, arch, createCmdFlags.secureBoot, resolveTalosVersion); err != nil {
 			return err
 		}
 
@@ -168,7 +169,7 @@ func createPreset(ctx context.Context, cmd *cobra.Command, client *client.Client
 	}
 
 	if createCmdFlags.overlay != "" {
-		if err = download.ValidateSBC(ctx, client.Omni().State(), createCmdFlags.overlay, validationTalosVersion); err != nil {
+		if err = download.ValidateSBC(ctx, client.Omni().State(), createCmdFlags.overlay, resolveTalosVersion); err != nil {
 			return err
 		}
 
@@ -178,10 +179,6 @@ func createPreset(ctx context.Context, cmd *cobra.Command, client *client.Client
 		}
 	}
 
-	if err = download.ValidateExtensions(ctx, client.Omni().State(), validationTalosVersion, createCmdFlags.extensions); err != nil {
-		return err
-	}
-
 	if createCmdFlags.labels != nil {
 		spec.MachineLabels, err = download.ParseLabelPairs(createCmdFlags.labels)
 		if err != nil {

client/pkg/omnictl/internal/download/download.go

@@ -328,6 +328,16 @@ func ValidateExtensions(ctx context.Context, st state.State, talosVersion string
 	return err
 }
 
+// ResolveExtensions expands short or partial extension names into full catalog names for the
+// given Talos version. Returns an error if any name has no match.
+func ResolveExtensions(ctx context.Context, st state.State, talosVersion string, extensions []string) ([]string, error) {
+	if len(extensions) == 0 {
+		return nil, nil
+	}
+
+	return lookupExtensions(ctx, st, talosVersion, extensions, false)
+}
+
 func checkMinTalosVersion(actual, minVersion, source string) error {
 	if minVersion == "" {
 		return nil

internal/backend/runtime/omni/validations/export_test.go

@@ -120,3 +120,7 @@ func MetadataValidationOptions() []validated.StateOption {
 func KubernetesHealthCheckValidationOptions() []validated.StateOption {
 	return kubernetesHealthcheckValidationOptions()
 }
+
+func ExtensionsConfigurationValidationOptions(st state.State) []validated.StateOption {
+	return extensionsConfigurationValidationOptions(st)
+}

internal/backend/runtime/omni/validations/extensions.go

@@ -0,0 +1,78 @@
+// Copyright (c) 2026 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package validations
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/extensions"
+)
+
+// MaxExtensionsCount caps the number of entries in a repeated extensions list. The value is
+// arbitrary, picked well above what real callers would send. Bump if needed.
+const MaxExtensionsCount = 256
+
+// validateExtensions checks each requested extension name against the TalosExtensions catalog. An
+// empty list is accepted. An empty Talos version is the "automatic" sentinel used by resources
+// like InstallationMediaConfig, in which case the default Talos version's catalog is used.
+// Names without a slash are looked up under the official extensions namespace so older clients
+// that send the documented short form keep working. The list is rejected if it exceeds MaxExtensionsCount or
+// contains duplicate entries.
+func validateExtensions(ctx context.Context, st state.State, talosVersion string, names []string) error {
+	if len(names) == 0 {
+		return nil
+	}
+
+	if len(names) > MaxExtensionsCount {
+		return fmt.Errorf("extensions list has %d entries, exceeds maximum of %d", len(names), MaxExtensionsCount)
+	}
+
+	if talosVersion == "" {
+		talosVersion = constants.DefaultTalosVersion
+	}
+
+	catalog, err := safe.StateGet[*omni.TalosExtensions](ctx, st, omni.NewTalosExtensions(talosVersion).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return fmt.Errorf("no Talos extensions catalog for version %q", talosVersion)
+		}
+
+		return fmt.Errorf("failed to look up Talos extensions catalog for version %q: %w", talosVersion, err)
+	}
+
+	available := make(map[string]struct{}, len(catalog.TypedSpec().Value.GetItems()))
+	for _, item := range catalog.TypedSpec().Value.GetItems() {
+		available[item.GetName()] = struct{}{}
+	}
+
+	seen := make(map[string]struct{}, len(names))
+
+	for i, name := range names {
+		lookup := name
+		if !strings.Contains(lookup, "/") {
+			lookup = extensions.OfficialPrefix + lookup
+		}
+
+		if _, ok := available[lookup]; !ok {
+			return fmt.Errorf("extension %q (entry %d) is not available for Talos version %q", name, i, talosVersion)
+		}
+
+		if _, ok := seen[lookup]; ok {
+			return fmt.Errorf("extension %q (entry %d) is listed more than once", name, i)
+		}
+
+		seen[lookup] = struct{}{}
+	}
+
+	return nil
+}

internal/backend/runtime/omni/validations/extensions_configuration.go

@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package validations
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
+)
+
+func extensionsConfigurationValidationOptions(st state.State) []validated.StateOption {
+	validate := func(ctx context.Context, res *omni.ExtensionsConfiguration) error {
+		extensions := res.TypedSpec().Value.GetExtensions()
+		if len(extensions) == 0 {
+			return nil
+		}
+
+		clusterID, ok := res.Metadata().Labels().Get(omni.LabelCluster)
+		if !ok || clusterID == "" {
+			return errors.New("extensions configuration with a non-empty extensions list must target a cluster via the cluster label")
+		}
+
+		cluster, err := safe.StateGet[*omni.Cluster](ctx, st, omni.NewCluster(clusterID).Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				return fmt.Errorf("cluster %q does not exist", clusterID)
+			}
+
+			return fmt.Errorf("failed to look up cluster %q: %w", clusterID, err)
+		}
+
+		return validateExtensions(ctx, st, cluster.TypedSpec().Value.GetTalosVersion(), extensions)
+	}
+
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(ctx context.Context, res *omni.ExtensionsConfiguration, _ ...state.CreateOption) error {
+			return validate(ctx, res)
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(ctx context.Context, _, newRes *omni.ExtensionsConfiguration, _ ...state.UpdateOption) error {
+			return validate(ctx, newRes)
+		})),
+	}
+}

internal/backend/runtime/omni/validations/infra_machine_config.go

@@ -19,7 +19,8 @@ import (
 	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
 )
 
-// MaxRequestIDLength caps the byte length of the request ID fields on InfraMachineConfig.
+// MaxRequestIDLength caps the byte length of the request ID fields on InfraMachineConfig. The
+// value is arbitrary, picked well above what real callers would send. Bump if needed.
 const MaxRequestIDLength = 128
 
 func infraMachineConfigValidationOptions(st state.State) []validated.StateOption {

internal/backend/runtime/omni/validations/installation_media_config.go

@@ -63,22 +63,22 @@ func installationMediaConfigValidationOptions(st state.State) []validated.StateO
 			return err
 		}
 
-		if version := spec.GetTalosVersion(); version != "" {
-			// Strip a leading "v" before the lookup so older omnictl clients that did not yet
-			// normalize the user input still validate against the canonical "1.2.3" form stored
-			// on Talos version resources.
-			lookup := strings.TrimPrefix(version, "v")
+		// Strip a leading "v" so older omnictl clients that did not yet normalize the user input
+		// still validate against the canonical "1.2.3" form stored on Talos version resources and
+		// the extensions catalog.
+		talosVersion := strings.TrimPrefix(spec.GetTalosVersion(), "v")
 
-			if _, err := safe.StateGet[*omni.TalosVersion](ctx, st, omni.NewTalosVersion(lookup).Metadata()); err != nil {
+		if talosVersion != "" {
+			if _, err := safe.StateGet[*omni.TalosVersion](ctx, st, omni.NewTalosVersion(talosVersion).Metadata()); err != nil {
 				if state.IsNotFoundError(err) {
-					return fmt.Errorf("unknown Talos version %q", version)
+					return fmt.Errorf("unknown Talos version %q", spec.GetTalosVersion())
 				}
 
-				return fmt.Errorf("failed to look up Talos version %q: %w", version, err)
+				return fmt.Errorf("failed to look up Talos version %q: %w", spec.GetTalosVersion(), err)
 			}
 		}
 
-		return nil
+		return validateExtensions(ctx, st, talosVersion, spec.GetInstallExtensions())
 	}
 
 	return []validated.StateOption{

internal/backend/runtime/omni/validations/kernel_args.go

@@ -14,6 +14,8 @@ import (
 	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
 )
 
+// The caps below are arbitrary, picked well above what real callers would send.
+// They bound user input. Bump if needed.
 const (
 	// MaxKernelArgLength caps the byte length of a single entry in a repeated kernel args list.
 	MaxKernelArgLength = 256

internal/backend/runtime/omni/validations/machine_request_set.go

@@ -41,5 +41,9 @@ func validateMachineRequestSet(ctx context.Context, st state.State, oldRes, res
 		return err
 	}
 
-	return validateTalosVersion(ctx, st, "", res.TypedSpec().Value.TalosVersion)
+	if err := validateTalosVersion(ctx, st, "", res.TypedSpec().Value.TalosVersion); err != nil {
+		return err
+	}
+
+	return validateExtensions(ctx, st, res.TypedSpec().Value.TalosVersion, res.TypedSpec().Value.GetExtensions())
 }

internal/backend/runtime/omni/validations/metadata.go

@@ -18,6 +18,8 @@ import (
 	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
 )
 
+// The caps below are arbitrary, picked well above what real callers would send.
+// They bound user input. Bump if needed.
 const (
 	// MaxResourceIDLength caps the byte length of a resource ID.
 	MaxResourceIDLength = 1024