Sign container images
Preconditions:
- Deployed cluster;
- Installed and workingModule for analyzing application configurations (Kyverno);
Kyverno, included with the Shturval platform, can verify container images hosted in docker or registry (Read more about how to set up authentication in a private registry). The most commonly used tool to sign container images and obtain the public key is Sigstore’s Cosign tool.
Configure image signature
You can sign images manually or build the process of signing images into the pipeline. To sign images you need:
- Have Cosign installed from Sigstore.
If you don’t have Cosign installed, use the command to install it. (Otherwise, skip this step). The installation must be performed from the device that will perform the signing (for example, on a machine with the registry enabled):
Command for Linux/macOS
curl -sSL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 -o /usr/local/bin/cosign
chmod +x /usr/local/bin/cosign
Command for Windows (PowerShell)
Invoke-WebRequest -URI https://github.com/sigstore/cosign/releases/latest/download/cosign-windows-amd64.exe -OutFile cosign.exe
- –key cosign.key
- –tlog-upload=false
If there is no valid certificate for the registry, you can use the flag:
- –allow-insecure-registry
Command for signing a container
cosign sign --key cosign.key --tlog-upload=false $IMAGE
During the signing process the following information will be displayed:
Generating ephemeral keys...
Retrieving signed certificate...
By typing 'y', you attest that you grant (or have permission to grant) and agree to have this information stored permanently in transparency logs.
Are you sure you would like to continue? [y/N] y
Your browser will now be opened to:
https://oauth2.sigstore.dev/auth/auth?access_type=online&client_id=sigstore&code_challenge=OrXitVKUZm2lEWHVt1oQWR4HZvn0rSlKhLcltglYxCY&code_challenge_method=S256&nonce=2KvOWeTFxYfxyzHtssvlIXmY6Jk&redirect_uri=http%3A%2F%2Flocalhost%3A57102%2Fauth%2Fcallback&response_type=code&scope=openid+email&state=2KvOWfbQJ1caqScgjwibzK2qJmb
Successfully verified SCT...
tlog entry created with index: 12086900
Pushing signature to: $IMAGE
Signing of images occurs with a private key, and verification with a public key. More details on Sigstore official page.
Configure signature verification
- If you do not have Cosign installed, use the command to install it. (Otherwise, skip this step). The installation must be performed on your workstation:
Command for Linux/macOS
curl -sSL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 -o /usr/local/bin/cosign
chmod +x /usr/local/bin/cosign
Command for Windows (PowerShell)
Invoke-WebRequest -URI https://github.com/sigstore/cosign/releases/latest/download/cosign-windows-amd64.exe -OutFile cosign.exe
- If you have not created a key pair for Cosign, create it usingI’ll give you the commands below. (Otherwise, skip this step)
Command for generating a key pair
cosign generate-key-pair
This command will create two files:
- cosign.key - private key
- cosign.pub - public key (used for verification)
- Extract the public key.
Command to extract the public key
cat cosign.pub
The result should look something like this:
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhUJv5NJ6Y5J5Z6X6X5X5X5X5X5X
5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X5X
-----END PUBLIC KEY-----
- In the Kubernetes cluster import the Kyverno policy, in the manifest of which specify the value of your public key:
Signature verification policy manifest. Don't forget to replace the public key value!!!
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
annotations:
policies.kyverno.io/category: infosec
policies.kyverno.io/description: Image signature verification lets you
verify image integrity and run containers only from
verified and trusted images
policies.kyverno.io/severity: High
policies.kyverno.io/title: Image Signature Checker
name: system-image-sign-check
spec:
admission: true
background: false
emitWarning: false
failurePolicy: Ignore
rules:
- match:
any:
- resources:
kinds:
- Pod
namespaceSelector:
matchExpressions:
- key: shturval.tech/system-namespace
operator: Exist
name: image-sign-check
skipBackgroundRequests: true
verifyImages:
- attestors:
- count: 1
entries:
- keys:
ctlog:
ignoreSCT: true
publicKeys: >-
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECp1Gvey7C3SPSsR4Xdxp3ffM55+j
ESzbBYgf71aw0P2ViS54eQ3jNJ7cKqj91hsM9XgowckvxDrRU5PSglg+7g==
-----END PUBLIC KEY-----
rekor:
ignoreTlog: true
signatureAlgorithm: sha256
signatureAlgorithm: sha256
- keys:
ctlog:
ignoreSCT: true
publicKeys: |-
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3dNylLLrn1TqigZ5gGGsG2r55pot
VnSGcEOsHXOSNwMUiBDal716IfJ1MBWrmeRrOlM0IwfWnXnuitM3Qgd0ew==
-----END PUBLIC KEY-----
rekor:
ignoreTlog: true
signatureAlgorithm: sha256
signatureAlgorithm: sha256
imageReferences:
- */*
mutateDigest: false
required: true
useCache: false
verifyDigest: true
schemaValidation: true
validationFailureAction: Audit
webhookTimeoutSeconds: 10
The downloaded policy appears in the cluster GUI under Security/Security Policy Manager. Please note! The policy blocks all containers that are not signed with this key, including system containers. The sample policy manifest above adds system container images to exceptions.