redhat-cop / image-scanning-signing-service

Image Signing and Scanning as a Service
36 stars 21 forks source link

Remote registry #29

Closed cnuland closed 4 years ago

cnuland commented 4 years ago

Allow the ability to sign images the formats of ImageStreamTag, ImageStreamImage, and DockerImage and include the ability to add pull secrets for remote registries.

Reproduce Tests:

apiVersion: imagesigningrequests.cop.redhat.com/v1alpha1
kind: ImageSigningRequest
metadata:
  name: dotnet-app
spec:
  containerImage:
    kind: ImageStreamImage
    name: dotnet-example@sha256:763683295a9cc2b0e03ae7a415fce417fca5388935ba74e2b5d9d4e9b6ca6178
apiVersion: imagesigningrequests.cop.redhat.com/v1alpha1
kind: ImageSigningRequest
metadata:
  name: dotnet-app
spec:
  containerImage:
    kind: ContainerRepository
    name: quay.io/redhat-cop/image-scanning-signing-service@sha256:a47ae897b964f1e543452c31a24bbd3d46ed5830f4a6d9992be97d0ce61ceb6b

and

apiVersion: imagesigningrequests.cop.redhat.com/v1alpha1
kind: ImageSigningRequest
metadata:
  name: dotnet-app
spec:
  containerImage:
    kind: ContainerRepository
    name: quay.io/redhat-cop/image-scanning-signing-service:latest

For a private repository I made one of my quay.io images private and added a pull secret

apiVersion: imagesigningrequests.cop.redhat.com/v1alpha1
kind: ImageSigningRequest
metadata:
  name: dotnet-app
spec:
  containerImage:
    kind: ContainerRepository
    name: quay.io/cnuland/hello-openshift:latest
  pullSecret:
    name: quay

NOTE: The E2E image now points by default to the signing image built by this repo. It now can run a test for both ImageStreamTag and ContainerRepository with tag. To run the E2E tests you'll need to make two modifications since,

name: SIGN_SCAN_IMAGE
  value: "quay.io/cnuland/image-signing-centos8"

and

image: quay.io/cnuland/image-signing-operator

Both pointing to the latest versions of the signer and operator.