Image verify attestors #3614

JimBugwadia · 2022-04-17T05:21:38Z

Related issue

Fixes #3502
Fixes #3199
Fixes #2583

Milestone of this PR

1.7

What type of PR is this

/kind feature

Proposed Changes

Allow multiple attestors (static keys, keyless, or nested attestors)

Proof Manifests

Added unit tests.

These currently invoke Cosign and should be migrated to CLI tests once #2866 is completed.

Checklist

I have read the contributing guidelines.
I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
This is a bug fix and I have added unit tests that prove my fix is effective.
This is a feature and I have added CLI tests that are applicable.
My PR needs to be cherry picked to a specific release branch which is .
My PR contains new or altered behavior to Kyverno and
- CLI support should be added and my PR doesn't contain that functionality.
- I have added or changed the documentation myself in an existing PR and the link is:
- I have raised an issue in kyverno/website to track the documentation update and the link is:

Further Comments

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

pkg/engine/imageVerify.go

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

pkg/engine/imageVerify.go

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

codecov-commenter · 2022-04-17T09:06:01Z

Codecov Report

❌ Patch coverage is 56.52174% with 60 lines in your changes missing coverage. Please review.
✅ Project coverage is 27.12%. Comparing base (1cfc80d) to head (b17dc2b).
⚠️ Report is 4715 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/engine/imageVerify.go	75.55%	15 Missing and 7 partials ⚠️
pkg/engine/utils/utils.go	0.00%	13 Missing ⚠️
api/kyverno/v1/image_verification_types.go	25.00%	11 Missing and 1 partial ⚠️
api/kyverno/v1/zz_generated.deepcopy.go	0.00%	10 Missing ⚠️
pkg/cosign/mock.go	0.00%	2 Missing ⚠️
pkg/engine/validate/validate.go	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3614      +/-   ##
==========================================
+ Coverage   26.82%   27.12%   +0.30%     
==========================================
  Files         137      137              
  Lines       19202    19255      +53     
==========================================
+ Hits         5150     5223      +73     
+ Misses      13420    13393      -27     
- Partials      632      639       +7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

realshuting

Do we have an issue tracking for doc updates?

bburky · 2022-04-19T23:38:30Z

Thanks, this feature looks great.

It's not clear to me, but it seems cosign.VerifySignature() and cosign.FetchAttestations() set cosignOpts.RootCerts (via getFulcioRoots(). Are the new Intermediates getting passed down somewhere into the cosignOpts.IntermediateCerts? I'm not seeing it. Maybe I'm not fully following these changes though.

JimBugwadia · 2022-04-20T01:23:33Z

Blake, I may have missed wiring up the cosign option. Will take a look and fix.

JimBugwadia · 2022-04-20T08:05:59Z

@bburky - updated in PR #3636

* fix logs Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix logs Signed-off-by: Jim Bugwadia <jim@nirmata.com> * support multiple attestors Signed-off-by: Jim Bugwadia <jim@nirmata.com> * rm CLI tests (not currently supported) Signed-off-by: Jim Bugwadia <jim@nirmata.com> * apply attestor repo Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix linter issues Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix entryError assignment Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix tests Signed-off-by: Jim Bugwadia <jim@nirmata.com> * format Signed-off-by: Jim Bugwadia <jim@nirmata.com> * add intermediary certs Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* feat: mutate existing, replace GR by UR in webhook server (#3601) * add attributes for post mutation Signed-off-by: ShutingZhao <shuting@nirmata.com> * add UR informer to webhook server Signed-off-by: ShutingZhao <shuting@nirmata.com> * - replace gr with ur in the webhook server; - create ur for mutateExsiting policies Signed-off-by: ShutingZhao <shuting@nirmata.com> * replace gr by ur across entire packages Signed-off-by: ShutingZhao <shuting@nirmata.com> * add YAMLs Signed-off-by: ShutingZhao <shuting@nirmata.com> * update api docs & fix unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * add UR deletion handler Signed-off-by: ShutingZhao <shuting@nirmata.com> * add api docs for v1beta1 Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix clientset method Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix v1beta1 client registration Signed-off-by: ShutingZhao <shuting@nirmata.com> * feat: mutate existing - generates UR for admission requests (#3623) Signed-off-by: ShutingZhao <shuting@nirmata.com> * replace with UR in policy controller generate rules (#3635) Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> * - enable mutate engine to process mutateExisting rules; - add unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * implemented ur background reconciliation for mutateExisting policies Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix webhook update error Signed-off-by: ShutingZhao <shuting@nirmata.com> * temporary comment out new unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * feat: mutate existing, replace GR by UR in webhook server (#3601) * add attributes for post mutation Signed-off-by: ShutingZhao <shuting@nirmata.com> * add UR informer to webhook server Signed-off-by: ShutingZhao <shuting@nirmata.com> * - replace gr with ur in the webhook server; - create ur for mutateExsiting policies Signed-off-by: ShutingZhao <shuting@nirmata.com> * replace gr by ur across entire packages Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix missing policy.kyverno.io/policy-name label (#3599) Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> * refactor cli code from pkg to cmd (#3591) * refactor cli code from pkg to cmd Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> * fixes in imports Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> * fixes tests Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> * fixed conflicts Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> * moved non-commands to utils Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com> * add YAMLs Signed-off-by: ShutingZhao <shuting@nirmata.com> * update api docs & fix unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * add UR deletion handler Signed-off-by: ShutingZhao <shuting@nirmata.com> * add api docs for v1beta1 Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix clientset method Signed-off-by: ShutingZhao <shuting@nirmata.com> * add-kms-libraries for cosign (#3603) * add-kms-libraries Signed-off-by: anushkamittal20 <anumittal4641@gmail.com> * Shifted providers to cosign package Signed-off-by: anushkamittal20 <anumittal4641@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * Add support for custom image extractors (#3596) Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net> * Update vulnerable dependencies (#3577) Signed-off-by: Shubham Gupta <shubham.gupta2956@gmail.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix v1beta1 client registration Signed-off-by: ShutingZhao <shuting@nirmata.com> * feat: mutate existing - generates UR for admission requests (#3623) Signed-off-by: ShutingZhao <shuting@nirmata.com> * updating version in Chart.yaml (#3618) * updatimg version in Chart.yaml Signed-off-by: Prateeknandle <prateeknandle@gmail.com> * changes from, make gen-helm Signed-off-by: Prateeknandle <prateeknandle@gmail.com> Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * Allow kyverno-policies to have preconditions defined (#3606) * Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Fix docs Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> Signed-off-by: ShutingZhao <shuting@nirmata.com> * replace with UR in policy controller generate rules (#3635) Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * - enable mutate engine to process mutateExisting rules; - add unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * implemented ur background reconciliation for mutateExisting policies Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix webhook update error Signed-off-by: ShutingZhao <shuting@nirmata.com> * temporary comment out new unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * Image verify attestors (#3614) * fix logs Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix logs Signed-off-by: Jim Bugwadia <jim@nirmata.com> * support multiple attestors Signed-off-by: Jim Bugwadia <jim@nirmata.com> * rm CLI tests (not currently supported) Signed-off-by: Jim Bugwadia <jim@nirmata.com> * apply attestor repo Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix linter issues Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix entryError assignment Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix tests Signed-off-by: Jim Bugwadia <jim@nirmata.com> * format Signed-off-by: Jim Bugwadia <jim@nirmata.com> * add intermediary certs Signed-off-by: Jim Bugwadia <jim@nirmata.com> * Allow defining imagePullSecrets (#3633) * Allow defining imagePullSecrets Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Use dict for imagePullSecrets Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Simplify how imagePullSecrets is defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> Signed-off-by: ShutingZhao <shuting@nirmata.com> * Fix race condition in pCache (#3632) * fix race condition in pCache Signed-off-by: ShutingZhao <shuting@nirmata.com> * refact: remove unused Run function from generate (#3638) Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> * Remove helm mode setting (#3628) Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * refactor: image utils (#3630) Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * -resolve lift comments; -fix informer sync issue Signed-off-by: ShutingZhao <shuting@nirmata.com> * refact the update request cleanup controller Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> * - fix delete request for mutateExisting; - fix context variable substitution; - improve logging Signed-off-by: ShutingZhao <shuting@nirmata.com> * - enable events; - add last applied annotation Signed-off-by: ShutingZhao <shuting@nirmata.com> * enable mutate existing on policy creation Signed-off-by: ShutingZhao <shuting@nirmata.com> * update autogen code Signed-off-by: ShutingZhao <shuting@nirmata.com> * merge main Signed-off-by: ShutingZhao <shuting@nirmata.com> * add unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * address list comments Signed-off-by: ShutingZhao <shuting@nirmata.com> * update api docs Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix "Implicit memory aliasing in for loop" Signed-off-by: ShutingZhao <shuting@nirmata.com> * remove unused definitions Signed-off-by: ShutingZhao <shuting@nirmata.com> * update api docs Signed-off-by: ShutingZhao <shuting@nirmata.com> Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com> Co-authored-by: Mritunjay Kumar Sharma <mritunjaysharma394@gmail.com> Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com> Co-authored-by: Anushka Mittal <55237170+anushkamittal20@users.noreply.github.com> Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com> Co-authored-by: Shubham Gupta <shubham.gupta2956@gmail.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com> Co-authored-by: Prateek Nandle <56027872+Prateeknandle@users.noreply.github.com> Co-authored-by: treydock <tdockendorf@osc.edu> Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

JimBugwadia added 5 commits April 16, 2022 22:06

fix logs

f07b075

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

fix logs

2620f87

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

support multiple attestors

c50c800

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

rm CLI tests (not currently supported)

8dda604

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

apply attestor repo

e73b517

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

JimBugwadia requested a review from prateekpandey14 as a code owner April 17, 2022 05:21

JimBugwadia requested review from Namanl2001, anushkamittal20, realshuting and sambhav and removed request for prateekpandey14 April 17, 2022 05:21

sonatype-lift bot reviewed Apr 17, 2022

View reviewed changes

pkg/engine/imageVerify.go Show resolved Hide resolved

sonatype-lift bot reviewed Apr 17, 2022

View reviewed changes

pkg/engine/imageVerify.go Outdated Show resolved Hide resolved

sonatype-lift bot reviewed Apr 17, 2022

View reviewed changes

pkg/engine/imageVerify.go Outdated Show resolved Hide resolved

fix linter issues

2720b0b

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

sonatype-lift bot reviewed Apr 17, 2022

View reviewed changes

pkg/engine/imageVerify.go Show resolved Hide resolved

JimBugwadia added 2 commits April 16, 2022 23:12

fix entryError assignment

3daa13c

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

fix tests

9887325

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

JimBugwadia added 4 commits April 17, 2022 02:25

format

2f4f10b

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Merge branch 'main' into image_verify_attestors

05b45cc

Merge branch 'main' into image_verify_attestors

017e2a4

add intermediary certs

b17dc2b

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

realshuting approved these changes Apr 19, 2022

View reviewed changes

vyankyGH approved these changes Apr 19, 2022

View reviewed changes

JimBugwadia merged commit 3b1a1ac into kyverno:main Apr 19, 2022

JimBugwadia deleted the image_verify_attestors branch April 26, 2022 06:54

dkulchinsky mentioned this pull request Apr 29, 2022

webhookconfig: include services/status if services resource configured #3740

Merged

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Image verify attestors #3614

Image verify attestors #3614

Uh oh!

JimBugwadia commented Apr 17, 2022 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Apr 17, 2022 •

edited by codecov bot

Loading

Uh oh!

realshuting left a comment

Uh oh!

bburky commented Apr 19, 2022

Uh oh!

JimBugwadia commented Apr 20, 2022

Uh oh!

JimBugwadia commented Apr 20, 2022

Uh oh!

Uh oh!

Image verify attestors #3614

Image verify attestors #3614

Uh oh!

Conversation

JimBugwadia commented Apr 17, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related issue

Milestone of this PR

What type of PR is this

Proposed Changes

Proof Manifests

Checklist

Further Comments

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Apr 17, 2022 • edited by codecov bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

realshuting left a comment

Choose a reason for hiding this comment

Uh oh!

bburky commented Apr 19, 2022

Uh oh!

JimBugwadia commented Apr 20, 2022

Uh oh!

JimBugwadia commented Apr 20, 2022

Uh oh!

Uh oh!

JimBugwadia commented Apr 17, 2022 •

edited

Loading

codecov-commenter commented Apr 17, 2022 •

edited by codecov bot

Loading