Skip to content

Commit

Permalink
Deployed 6233669 to develop with MkDocs 1.6.1 and mike 2.0.0
Browse files Browse the repository at this point in the history
  • Loading branch information
versioning_user committed Sep 27, 2024
1 parent 922acc9 commit f9c9290
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 10 deletions.
2 changes: 1 addition & 1 deletion develop/search/search_index.json

Large diffs are not rendered by default.

18 changes: 9 additions & 9 deletions develop/validators/sigstore_cosign/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -537,9 +537,9 @@
</li>

<li class="md-nav__item">
<a href="#k8s_keychain" class="md-nav__link">
<a href="#k8s-keychain" class="md-nav__link">
<span class="md-ellipsis">
k8s_keychain
K8s keychain
</span>
</a>

Expand Down Expand Up @@ -1418,9 +1418,9 @@
</li>

<li class="md-nav__item">
<a href="#k8s_keychain" class="md-nav__link">
<a href="#k8s-keychain" class="md-nav__link">
<span class="md-ellipsis">
k8s_keychain
K8s keychain
</span>
</a>

Expand Down Expand Up @@ -1638,10 +1638,10 @@ <h2 id="configuration-options">Configuration options<a class="headerlink" href="
<td>Name of a Kubernetes secret in Connaisseur namespace that contains <a href="https://kubernetes.io/docs/concepts/configuration/secret/#docker-config-secrets">dockerconfigjson</a> for registry authentication. See additional notes <a href="#dockerconfigjson">below</a>.</td>
</tr>
<tr>
<td><code>auth.k8sKeychain</code></td>
<td><code>auth.useKeychain</code></td>
<td><code>false</code></td>
<td>-</td>
<td>When true, pass <code>--k8s-keychain</code> argument to <code>cosign verify</code> in order to use workload identities for authentication. See additional notes <a href="#k8s_keychain">below</a>.</td>
<td>When true, pass <code>--k8s-keychain</code> argument to <code>cosign verify</code> in order to use workload identities for authentication. See additional notes <a href="#k8s-keychain">below</a>.</td>
</tr>
<tr>
<td><code>cert</code></td>
Expand Down Expand Up @@ -1741,8 +1741,8 @@ <h4 id="dockerconfigjson">dockerconfigjson<a class="headerlink" href="#dockercon
</div>
<p>In the above cases, the secret name in Connaisseur configuration would be <code>secretName: my-secret</code>.
It is possible to provide one Kubernetes secret with a <code>config.json</code> for authentication to multiple private registries and referencing this in multiple validators.</p>
<h4 id="k8s_keychain">k8s_keychain<a class="headerlink" href="#k8s_keychain" title="Permanent link">⚓︎</a></h4>
<p>Specification of <code>auth.k8sKeychain: true</code> in the validator configuration passes the <code>--k8s-keychain</code> to <code>cosign</code> when performing image validation.
<h4 id="k8s-keychain">K8s keychain<a class="headerlink" href="#k8s-keychain" title="Permanent link">⚓︎</a></h4>
<p>Specification of <code>auth.useKeychain: true</code> in the validator configuration passes the <code>--k8s-keychain</code> to <code>cosign</code> when performing image validation.
Thus, <a href="https://pkg.go.dev/github.com/google/go-containerregistry/pkg/authn/k8schain">k8schain</a> is used by <code>cosign</code> to pick up ambient registry credentials from the environment and for example use workload identities in case of common cloud providers.</p>
<p>For example, when validating against an ECR private repository, the credentials of an IAM user allowed to perform actions
<code>ecr:GetAuthorizationToken</code>, <code>ecr:BatchGetImage</code>, and <code>ecr:GetDownloadUrlForLayer</code> could be added to the secret <code>connaisseur-env-secrets</code>:</p>
Expand All @@ -1757,7 +1757,7 @@ <h4 id="k8s_keychain">k8s_keychain<a class="headerlink" href="#k8s_keychain" tit
<span class="w"> </span><span class="nt">AWS_SECRET_ACCESS_KEY</span><span class="p">:</span><span class="w"> </span><span class="err">***</span>
<span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">...</span>
</code></pre></div>
<p>If <code>k8sKeychain</code> is set to <code>true</code> in the validator configuration, <code>cosign</code> will log into ECR at time of validation.
<p>If <code>useKeychain</code> is set to <code>true</code> in the validator configuration, <code>cosign</code> will log into ECR at time of validation.
See <a href="https://github.com/sigstore/cosign/pull/972">this cosign pull request</a> for more details.</p>
<h3 id="kms-support">KMS Support<a class="headerlink" href="#kms-support" title="Permanent link">⚓︎</a></h3>
<p>Connaisseur supports Cosign's URI-based <a href="https://github.com/sigstore/cosign/blob/main/KMS.md">KMS integration</a> to manage the signing and verification keys.
Expand Down

0 comments on commit f9c9290

Please sign in to comment.