Signing and verifying Container Registry Docker images in Yandex Managed Service for Kubernetes

This scenario describes how to sign Docker images using Cosign in Yandex Container Registry and then set up signature verification in Yandex Managed Service for Kubernetes.

To sign Docker images and set up their verification:

1. Sign a Docker image using Cosign.
2. Create a policy for signature verification.
3. Check the result.

If you no longer need the resources you created, delete them.

Getting startedGetting started

Prepare the infrastructurePrepare the infrastructure

Get ready to use the Managed Service for Kubernetes clusterGet ready to use the Managed Service for Kubernetes cluster

1. Install kubectl and configure it to work with the created cluster.

2. Install the Kubernetes Helm package manager.

Add multiple Docker images to the Container Registry registryAdd multiple Docker images to the Container Registry registry

1. Configure Docker and get authenticated in Container Registry.
2. Create multiple Docker images. One image will be signed using Cosign, while others will remain unsigned.
3. Push Docker images to the Container Registry registry.

Sign a Docker image using CosignSign a Docker image using Cosign

Create a policy for signature verificationCreate a policy for signature verification

1. Create an authorized key for the service account with the container-registry.images.puller role and save it to the file:

   yc iam key create \
     --service-account-name=<service_account_name> \
     --output authorized-key.json
   

   Where --service-account-name: Name of the service account with the container-registry.images.puller role.

2. Install the Kyverno app to the Managed Service for Kubernetes cluster. You need it to create a policy for verifying Docker image signatures.

   1. Add a repository named kyverno:

      helm repo add kyverno https://kyverno.github.io/kyverno/
      

      Result:

      "kyverno" has been added to your repositories
      

   2. Install Kyverno to the kyverno namespace:

      helm install kyverno kyverno/kyverno \
        --namespace kyverno \
        --create-namespace \
        --set replicaCount=1 \
        --set imagePullSecrets.regcred.registry=cr.yandex \
        --set imagePullSecrets.regcred.username=json_key \
        --set-file imagePullSecrets.regcred.password=./authorized-key.json
      

      Result:

      NAME: kyverno
      LAST DEPLOYED: Thu Sep 8 10:43:00 2022
      NAMESPACE: kyverno
      STATUS: deployed
      ...
      

3. Create a policy:

   1. Save the ClusterPolicy creation specification to a YAML file named policy.yaml:

      apiVersion: kyverno.io/v1
      kind: ClusterPolicy
      metadata:
        name: check-image
      spec:
        validationFailureAction: enforce
        background: false
        webhookTimeoutSeconds: 30
        failurePolicy: Fail
        rules:
          - name: check-image
            match:
              any:
              - resources:
                  kinds:
                    - Pod
            verifyImages:
            - imageReferences:
              - "cr.yandex/<registry_ID>/*"
              attestors:
              - count: 1
                entries:
                - keys:
                    publicKeys: |-
                      <cosign.pub_contents>
      

      Example of a filled out policy.yaml file

      apiVersion: kyverno.io/v1
      kind: ClusterPolicy
      metadata:
        name: check-image
      spec:
        validationFailureAction: enforce
        background: false
        webhookTimeoutSeconds: 30
        failurePolicy: Fail
        rules:
          - name: check-image
            match:
              any:
              - resources:
                  kinds:
                    - Pod
            verifyImages:
            - imageReferences:
              - "cr.yandex/crpd2f2bnrlb********/*"
              attestors:
              - count: 1
                entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1jTu/9rJZZvUFi4bGhlvgMQdIY97
                      7NuGl2zzpV7olAyIu/WiywxI7Fny5tk6JmNPIFvSAtys3c08gfEc********
                      -----END PUBLIC KEY-----
      

      Note

      By default, when you create a policy, a signature verification request is made to the Transparency Log immutable record storage. You can disable this behavior by adding the rekor: ignoreTlog: true parameter to the keys element of the policy specification. For more information, see the Kyverno documentation.

   2. Run this command:

      kubectl apply -f ./policy.yaml
      

      Result:

      clusterpolicy.kyverno.io/check-image configured
      

4. (Optional) Install Policy Reporter in your Managed Service for Kubernetes cluster to be able to save and process policy results.

Check the resultCheck the result

• Create a pod from the signed Docker image:

  kubectl run pod --image=cr.yandex/<registry_ID>/<Docker_image_name>:<tag>
  

  Result:

  pod/pod created
  

• Create a pod from an unsigned Docker image:

  kubectl run pod2 --image=cr.yandex/<registry_ID>/<unsigned_Docker_image_name>:<tag>
  

  Result:

  Error from server: admission webhook "mutate.kyverno.svc-fail" denied the request:
  
  resource Pod/default/pod2 was blocked due to the following policies
  
  check-image:
    check-image:
      failed to verify signature for cr.yandex/crpsere9njsa********/alpine:2.0: .attestors[0].entries[0].keys: no matching signatures:
  

Delete the resources you createdDelete the resources you created

Some resources are not free of charge. To avoid paying for them, delete the resources you no longer need: