search

ratify-project / ratify

Artifact Ratification Framework
https://ratify.dev
Apache License 2.0
188 stars 56 forks source link

Notify users early if keymanagementprovider resource does not exist #1452

Open yizha1 opened 1 month ago

yizha1 commented 1 month ago

What would you like to be added?

I configured the cosign verifier with non-existing keymanagementprovider resource, the command kubectl get verifier cosign-verifier indicated a success. However, when I started to deploy an image, the deployment failed as expected. The Ratify log showed the keymanagementprovider resource did not exist.

Anything else you would like to add?

Is it feasible to proactively notify users about configuration issues? In real-world scenarios, typos or other configuration errors can occur. For instance, when users run kubectl get verifier to check the status, everything might appear fine initially. However, these configuration issues may only surface during image deployment. In large-scale deployments, multiple error logs related to the same configuration issue can accumulate, which could be better avoided to conserve cluster resources.

Are you willing to submit PRs to contribute to this feature?

susanshi commented 2 weeks ago

Verifier and KMPs are reconciled separately, is there a way to guarantee the order?

susanshi commented 1 week ago

Discussion from PR review: We have two options:

  1. The verifier would error out if referenced KMP was not found ( so a retry could be triggered)
  2. We could print a warning that KMP did not exist, and move on.
binbin-li commented 1 week ago

As we discussed in the PR review meeting, we could also investigate the path that makes KMP reconciler to trigger Verifier reconciliation.