CASM-4908 Runtime container image signature validation #5455
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Oct 10, 2024
mtupitsyn
commented
Oct 10, 2024
| @@ -62,23 +62,9 @@ spec: | |||
| podman tag skopeo:csm-{{ getEnv "CSM_RELEASE" }} quay.io/skopeo/stable:latest | |||
|
|
|||
| podman run --rm --network host -v {{ getEnv "CSM_PATH" }}/docker:/images:ro \ | |||
| quay.io/skopeo/stable sync --scoped --src dir --dest docker --dest-tls-verify=false --dest-creds admin:admin123 \ | |||
| quay.io/skopeo/stable sync --all --scoped --src dir --dest docker --dest-tls-verify=false --dest-creds admin:admin123 \ | |||
There was a problem hiding this comment.
This step actually duplicates upload, performed by setup-nexus.sh script for metal nexus, so I'm am not sure if we need it at all. But if we do upload, we must include --all option. Otherwise, skopeo only uploads amd64 manifest without signature, which overrides original multi-platform manifest and detaches existing signature.
mtupitsyn
force-pushed
the
feature/prepend-registry
branch
from
5dba86b to
ee66d94
Compare
* Kyverno may have been moved to separate manifest - support both locations * Kyverno should be installed after restart of services which are not yet upgraded * Strip registry.local/ prefix when uploading images to Nexus for pre-caching * 'Initialiaze Boostrap Registry' phase of fresh install did not handle multi-arch images correctly
mtupitsyn
force-pushed
the
feature/prepend-registry
branch
from
ee66d94 to
9870b76
Compare
|
This pull-request has not had activity in over 20 days and is being marked as stale. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary and Scope
During initial testing of image signature validation, it was discovered that Kyverno tries to contact https://artifactory.alogl60.net/ for image verification, and this blocks deployments in air-gapped environments, even in Audit mode (CASMTRIAGE-7283). We need to set Kyverno to contact local registry instead, for both images and their respective signatures. This will allow us to turn on signature validation in runtime (during initial deployments, upgrades and in background on running clusters).
Proposed solution involves these key steps:
prepend-registry, which will automatically addregistry.local/to the beginning of image spec for any new pod (if it doesn't already start withregistry.local/).registry.local/are looked inhttps://pit.nmnfirst and inhttps://registry.local/second. This rule is needed to support a switch from PIT Nexus to Cloud Nexus during initial install. It is similar to already existing rule for image names starting fromartifactory.algol60.net, which now becomes obsolete.This change consists of the following PR's:
Issues and Related PRs
Testing
Tested on:
Test description:
validationFailureActionset toAuditandEnforce.Risks and Mitigations
None known ATM.
Pull Request Checklist