Audit of Docker Images integrity in cluster for microservices

[chpapa]

Description

A feature issue for internal audit of our measures to ensure Docker Image integrity.

References:

• Usage of Docker Content Trust / notary (which is based on tuf at docker images update/acceptance?

Related Issues

• Server Issues
• Client Issues
• Guides Issues

[carmenlau]

Did some research about enabling docker content trust in k8s. There is no native way to enable docker content trust in k8s. https://github.com/kubernetes/kubernetes/issues/30603

And the images in k8s.gcr.io are not signed too. So we cannot enable docker content trust for the whole cluster... https://github.com/kubernetes/kubernetes/issues/63704