44 lines
1.5 KiB
YAML
44 lines
1.5 KiB
YAML
# Cluster khud signature check karta hai. Pipeline bhi karti hai, par wo bypass
|
|
# ho sakti hai - ye nahi. Bina cosign signature wali image pod ban hi nahi sakti.
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: verify-image-signature
|
|
annotations:
|
|
policies.kyverno.io/description: >-
|
|
Private registry se aane wali har image cosign se signed honi chahiye.
|
|
spec:
|
|
background: false
|
|
webhookConfiguration:
|
|
failurePolicy: Fail
|
|
rules:
|
|
- name: check-cosign-signature
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds: [Pod]
|
|
namespaces: ["demo-app", "hello-api"]
|
|
verifyImages:
|
|
- imageReferences:
|
|
- "ns31240276.ip-51-195-4.eu:5000/*"
|
|
failureAction: Enforce
|
|
# digest par rewrite nahi karte - warna ArgoCD ko drift lagta hai
|
|
# aur selfHeal se khaamakhaan ladai hoti hai.
|
|
mutateDigest: false
|
|
verifyDigest: false
|
|
required: true
|
|
attestors:
|
|
- count: 1
|
|
entries:
|
|
- keys:
|
|
publicKeys: |-
|
|
-----BEGIN PUBLIC KEY-----
|
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEO+rCXEKByVGTiB+2zDA4gr495oib
|
|
zNMItTZ+s4xYETg4ZoTOJTCxo83uAPDrD8xesWp1ttWYUbR6xcq2g7kagw==
|
|
-----END PUBLIC KEY-----
|
|
# tlog upload band hai (private registry), verify bhi offline
|
|
ctlog:
|
|
ignoreSCT: true
|
|
rekor:
|
|
ignoreTlog: true
|