-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Closed
Labels
enhancementNew feature or requestNew feature or requestimageVerifyImage verification supportImage verification support
Milestone
Description
Is your feature request related to a problem? Please describe.
This is not related to a problem, it is just a question.
Describe the solution you'd like
Hello, as you might know, we can sign our container images multiple times with different keys via cosign. I'm just wondering that the images within the policy below can be configurable to support that?
check_image_cp.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-image
spec:
validationFailureAction: enforce
background: false
webhookTimeoutSeconds: 30
failurePolicy: Fail
rules:
- name: check-image
match:
resources:
kinds:
- Pod
verifyImages:
- image: "ghcr.io/kyverno/test-verify-image:*"
key: |-
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
-----END PUBLIC KEY-----
For example like the following (same image with a different key):
verifyImages:
- image: "ghcr.io/kyverno/test-verify-image:*"
key: |-
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
-----END PUBLIC KEY-----
- image: "ghcr.io/kyverno/test-verify-image:*"
key: |-
-----BEGIN PUBLIC KEY-----
Another blob
-----END PUBLIC KEY-----
Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
Additional context
Add any other context or screenshots about the feature request here.
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or requestimageVerifyImage verification supportImage verification support