Anyone configured connaisseur with private acr and docker content trust?

[amitsaurabh32]

Hi All,

Can anyone suggest what are all the changes we need to perform in values.yml file in order to configure connaisseur with private acr?

[xopham]

@amitsaurabh32 this was tested some time ago, but there is dedicated information on this in the docs: https://sse-secure-systems.github.io/connaisseur/v3.1.1/validators/notaryv1/#using-azure-container-registry

Hope it still works 🙏

[amitsaurabh32]

Hi @xopham,

After changing the policy pattern i am getting the same unauthorized error, could you please suggest what permission connaisseur is expecting for our private repository, I have added auth.username and auth.password of the service principle which have reader permission for acr repository.

And we haven't configured any notary server for our acr so should we use type: notaryv1 for our validator or not ?

If Not what should be the type of our validator in case of acr ?

validators:

• name: myvnvacr-validator
  isAcr: true
  type: notaryv1

[xopham]

Let's recap. You are using the following policy:

validators:
- name: myvnvacr-validator
isAcr: true
type: notaryv1
host: xxxxxxxxxxxxxxxxxxx.azurecr.io
trustRoots:
- name: myvnvacr-validator
key: |
-----BEGIN PUBLIC KEY-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END PUBLIC KEY-----
auth:
username: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
password: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

policy:
- pattern: "xxxxxxxxxxxxxxxxxxxxxxx.azurecr.io/:"
validator: myvnvacr-validator
with:
trustRoot: myvnvacr-validator

I understand there is no other validators or policy pattern configured, right?

When you change the pattern:

validators:
- name: myvnvacr-validator
isAcr: true
type: notaryv1
host: xxxxxxxxxxxxxxxxxxx.azurecr.io
trustRoots:
- name: myvnvacr-validator
key: |
-----BEGIN PUBLIC KEY-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END PUBLIC KEY-----
auth:
username: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
password: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

policy:
- pattern: "yyyyyyyyyyyyyyyyyyyy.azurecr.io/:"
validator: myvnvacr-validator
with:
trustRoot: myvnvacr-validator

You still get Unauthorized?
That would seem to indicate that your configured validator is never applied. Essentially, Connaisseur matches the image against the policies and if one matches, it will apply the validator. Now, changing the policy pattern should have shifted you from matched to not-matched, but the msg remains the same, right?

[amitsaurabh32]

Hi @xopham,

yes, correct there is no other validator and policy pattern is configured, And yes I am still getting Unauthorized error but one more strange error I have observed from the first error log which i have shared below as well.

ryv1/notary.py", line 232, in __get_auth_token\n response.raise_for_status()\n File "/usr/local/lib/python3.11/site-packages/aioh
ttp/client_reqrep.py", line 1005, in raise_for_status\n raise ClientResponseError(\naiohttp.client_exceptions.ClientResponseError:
401, message='Unauthorized', url=URL('https://xxxxxxxxxxxxxxxxxxxxxxxx.azurecr.io/oauth2/token?service=xxxxxxxxxxxxxxxxxxx.azurecr.io&scop
e=repository:xxxxxxxxxxxxxxxxxxxxxxx.azurecr.io/connaisseur-test1:pull')\n"}
{"timestamp": "2023-10-17 08:14:35.269689", "client_ip": "10.244.0.1", "method": "POST", "path": "/mutate", "query": "timeout=30s", "pr
otocol": "HTTP/1.1", "status_code": "200"}

If you observe the repository url "repository:xxxxxxxxxxxxxxxxxxxxxxx.azurecr.io/connaisseur-test1:pull'" its structure should be myacr.azure.io/repositoryname:tagname . But in the error log tag name is appearing as pull instead of my original tag name. Could you please advise if this is expected or there is something wrong with this.

[xopham]

Can't actively test right now. Could you check what happens if you push an image with tag "pull" and repeat?
Here, is the strange thing: If your pattern does not match, your configured validator is not used. Let's test that. Could you extend your configuration with the following entries:

application:
  validators:
  - name: deny
    type: static
    approve: false
  policy:
    - pattern: "*:*"
      validator: deny

In this case, your pod should not meet your specific pattern and fall back to this one and be denied bc it is set to be default denied. this should result in:

Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: Static deny.

[amitsaurabh32]

Hi @xopham,

I tried with the below configuration as per your suggestion and receiving the message Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: Static deny.

`application:
validators:

• name: deny
  type: static
  approve: false
  policy:
  • pattern: ":"
    validator: deny`

But when I am reverting my validator for my acr with below configuration

`validators:

• name: myvnvacr-validator
  isAcr: true
  type: notaryv1
  host: xxxxxxxxxxxxxxxxxxx.azurecr.io
  trustRoots:
• name: myvnvacr
  key: |
  -----BEGIN PUBLIC KEY-----
  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  -----END PUBLIC KEY-----
  auth:
  username: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  password: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

policy:

• pattern: ":"
  validator: myvnvacr-validator
  with:
  trustRoot: myvnvacr`

I am again getting the same unauthorized error which i was receiving at the first instance. although i have provided reader permission to my service principle for my private acr repository and the same authusername and password i am using in my validator.

Request you to please advice what kind of permission it is looking for my private acr?