Controller Does Not Return Image Digest if Trust Policy is Set to Skip signatureVerification for a Registry

[b-eisen]

Scenario: I have a multi-container Pod with a main container and two init containers which are injected by another controller. I only want to validate the signature of the main container, which I signed with the Notation AWS Signer plugin. I configured the trust policy to skip verification of the other two containers by adding an additional trust policy block which had their registries set and signatureVerifcation set to level: skip. When the controller finishes signature checking it returns a results object with the 3 containers, and only the container that was checked is returned with the digest, the other two only with the tag.

This causes downstream issues with the mutate block of the cluster policy, because you cannot mutate back to an image tag or the admission controller fails validation.

Using: v1rc-1

[b-eisen]

Adding sample redacted response:

verifier/response.go:86 Sending response result=[{Name:pipeline-builder-image Path:/spec/containers/0/image Image:<redacted>.dkr.ecr.us-east-1.amazonaws.com/<repo-name>@sha256:db61b6cf893d45304e3cb9d1c19d856cd6a5c88e9b119dacca188ad65b6e5fb6} {Name:busybox Path:/spec/initContainers/1/image Image:cgr.dev/chainguard/busybox:} {Name:entrypoint Path:/spec/initContainers/0/image Image:gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/entrypoint:v0.47.0}]

[vishal-chdhry]

Here, we will only be mutating digests for images that are in ECR as it is a possibility that the service does not have required permissions to access other registries.

We don't want to add auth for other registries since this usecase is already covered by kyverno and this service is specific to AWS

[b-eisen]

@vishal-chdhry - I'm hearing what you're saying. However you could use AWS Signer and notation to sign images that reside outside of ECR. So how could you better configure policies in the scenario I stated?

[JimBugwadia]

Hi @b-eisen - if the goal is to mutate digests for other images that are not signed with AWS Signer and notation, an option is to use the Kyverno verify image rule with verifyDigest and mutateDigest set to true.

For other registries, it should be possible to configure credentials via the secret, etc.