Skip to content

supporting verification of container images via cosign with multiple public keys  #2583

@developer-guy

Description

@developer-guy

Is your feature request related to a problem? Please describe.
This is not related to a problem, it is just a question.

Describe the solution you'd like

Hello, as you might know, we can sign our container images multiple times with different keys via cosign. I'm just wondering that the images within the policy below can be configurable to support that?

check_image_cp.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-image
spec:
  validationFailureAction: enforce
  background: false
  webhookTimeoutSeconds: 30
  failurePolicy: Fail
  rules:
    - name: check-image
      match:
        resources:
          kinds:
            - Pod
      verifyImages:
      - image: "ghcr.io/kyverno/test-verify-image:*"
        key: |-
          -----BEGIN PUBLIC KEY-----
          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
          5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
          -----END PUBLIC KEY-----          

For example like the following (same image with a different key):

verifyImages:
  - image: "ghcr.io/kyverno/test-verify-image:*"
    key: |-
    -----BEGIN PUBLIC KEY-----
    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
    5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
    -----END PUBLIC KEY-----          
  - image: "ghcr.io/kyverno/test-verify-image:*"
    key: |-
    -----BEGIN PUBLIC KEY-----
    Another blob
    -----END PUBLIC KEY-----      

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or requestimageVerifyImage verification support

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions