search

sigstore / helm-charts

Helm charts for sigstore project
Apache License 2.0
65 stars 93 forks source link

Error when deploying image in cosigned enforced namespace #200

Closed trondat closed 1 year ago

trondat commented 2 years ago

Hi,

When trying to run an image in a namespace that is "cosigned enabled" , the webhook throws an error : 

Error from server (BadRequest): admission webhook "cosigned.sigstore.dev" denied the request: validation failed: invalid value: signed-image:master must be an image digest: spec.containers[0].image

The image is signed with cosign and verified with cosign using the same public key that is used for cosigned on K0s.

The same also applies when trying to deploy an unsigned image.

Any suggestion on what is wrong?

hectorj2f commented 2 years ago

@trondat The policy-controller webhook now requires digest references to validate references since the tag can move. So it is an expected behavior.

bheisig commented 2 years ago

IMHO this (new?) behavior is too strict when you just start signing and verifying container images. Is it possible to make this optional? In my use care I don't care about image digests but care about image tags. All my images are signed by me. I "only" want to make sure every single container image from my private registry is built by me.

hectorj2f commented 2 years ago

The decision comes to enforce the security of the verification.

sabre1041 commented 1 year ago

Closing issue has this is related to the policy-controller (then known as cosigned) and is not related to the chart itself