Added image-policy proposal #27129

erictune · 2016-06-09T16:04:51Z

Add proposal for image policy.

erictune · 2016-06-09T16:05:47Z

erictune · 2016-06-09T16:08:34Z

@philips it might make sense to have https://github.com/coreos/clair be a backend for this image policy webhook, or something like that? Can you at-mention the right people from Clair?

Also @ericchiang because it is a type of authorization, but intentionally not in RBAC.

erictune · 2016-06-09T16:15:31Z

@roberthbailey

ericchiang · 2016-06-09T16:52:09Z

docs/proposals/image-provenance.md

+- For non-replicated things (size 1 ReplicaSet, PetSet), a single node failure may disable it.
+- a node rolling update will eventually check for liveness of replacements, and would be throttled if
+  in the case when the image was no longer allowed and so replacements could not be started.
+- rapid node restarts will cause existing pod objects to be restared by kubelet.


s/restared/restarted/

erictune · 2016-06-09T17:41:02Z

@jerbia

ericchiang · 2016-06-09T17:55:27Z

cc @gtank @ecordell

smarterclayton · 2016-06-09T18:08:12Z

docs/proposals/image-provenance.md

+ }
+
+// ImageReviewSpec is a description of the token authentication request.
+type ImageReviewSpec struct {


Do we need to know the authenticated user / service account that is attempting to perform this action? Who can matter as much as what in this case.

Nm, saw the comment below. Commented there.

erictune · 2016-06-13T15:31:33Z

xref: #22888

alex-mohr · 2016-06-21T00:32:49Z

docs/proposals/image-provenance.md

+- a newly created replicaSet will be unable to create Pods.
+- updating a deployment will be safe in the sense that it will detect that the new ReplicaSet is not scaling
+  up and not scale down the old one.
+- an existing replicaSet will not be unable to create Pods that replace ones which are terminated.  If this is due to


nit: "will not be unable to create" -> "will be unable to create"

bgrant0607 · 2016-06-22T19:44:36Z

docs/proposals/image-provenance.md

+
+## Admission controller
+
+An `ImagePolicyWebhook` admission controller will be written.  The admission controller examines all pod objects which are


Is the webhook going to be tried until success? How would it distinguish retryable failure from permanent failure?

The admission controller will admit if the webhook times out.

Will the admin be able to set a policy for a namespace (e.g., fail-open/fail-closed)?

Will this be a generic webhook for any admission plugin? I'd like to see a generic one and it seems like the work here would be about the same.

It will not be a generic webhook. A generic webhook would need a lot more discussion:

a generic webhook needs to touch all objects, not just pods. So it won't have a fixed schema

a generic webhook client needs to ignore kinds it doesn't care about, or the apiserver needs to know which backends care about which kinds

it exposes our whole API to a webhook without giving us (the project) any chance to review or understand how it is being used.

because we don't know which fields of an object are inspected by the backend, caching is not effective. Sending fewer fields allows caching.

sending fewer fields makes it possible to rev the version of the webhook request slower than the version of our internal obejcts (e.g. pod v2 could still use imageReview v1.)

probably lots more reasons.

Added section about this in Alternatives section.

erictune · 2016-07-23T00:33:38Z

@fabioy this is the proposal for image admission controller that we talked about.

philips · 2016-07-23T02:04:20Z

docs/proposals/image-provenance.md

+ - only run images that are scanned to confirm they do no contain vulnerabilities
+ - only run images that use a "required" base image
+ - only run images that contain binaries which were built from peer reviewed, checked-in source
+   by a trusted compiler toolchain.


@erictune isn't the other obvious example images that are signed by a public key in a key list?

Yes. I would do that in conjunction with other controls. I might want to also enforce the whitelist of signing keys at the node level, at which point the check in the apiserver is more a nice-to-have. But you could do it that way.

Adding your suggestion to the doc.

erictune · 2016-07-25T23:49:52Z

I've addressed most comments and updated the docs.

The open issues, as I see it, are:

how to handle init-containers
if the schema should be a subset of PodSpec, so that additional fields fall in the same places.
something about interfaces that I don't quite follow.

smarterclayton · 2016-07-26T00:56:42Z

Interfaces was about making the guts of the admission controller call a policy interface that looks like Authorizer and Admission interfaces, because it imposes discipline and also may lead to experimentation.

philips · 2016-07-27T00:28:26Z

cc the Clair team @Quentin-M @jzelinskie @josephschorr

jzelinskie · 2016-07-27T00:46:02Z

docs/proposals/image-provenance.md

+## Admission controller
+
+An `ImagePolicyWebhook` admission controller will be written.  The admission controller examines all pod objects which are
+created or updated.  It can either admit the pod, or reject it.  If it is rejected, the request sees a `403 FORBIDDEN`


This description is a little vague in the plurality sense. I think this should work over a set of webhooks rather than one. For example, this Pull Request on GitHub has multiple webhooks that must validate it before it is merged.

I kinda understood this as being able to setup multiple, but having it explicit in the proposal is a good idea.

This description is a little vague in the plurality sense. I think this should work over a set of webhooks rather than one. For example, this Pull Request on GitHub has multiple webhooks that must validate it before it is merged.

Seems like we could support a single callout and if someone wanted a union, they could write the union in their particular handler. That keeps our core code out of the business of deciding between the ands, ors, and trumps, which inevitably follow the "give me more than one".

I don't see an issue with making a reference impl for the webhook that can provide a simple union, but I don't think we want to bake multiples into our admission plugin.

I feel convinced.

@deads2k It seems there's precedent in other parts of k8s for doing it the way you have described, so I agree.

ericchiang · 2016-08-03T15:34:21Z

docs/proposals/image-provenance.md

+The WebHook request and response are JSON, and correspond to the following `go` structures:
+
+```go
+// Filename: pkg/apis/authentication.k8s.io/register.go


Are these types intended to live in the authentication.k8s.io API group? Is the package name correct here?

Q-Lee · 2016-08-03T23:55:01Z

docs/proposals/image-provenance.md

+
+// ImageReviewContainerSpec is a description of a container within the pod creation request.
+type ImageReviewContainerSpec struct {
+	Image string


Shouldn't this be Image, ImageHash string?

Images can be specified to docker, and in pod.spec.container[].image as either image:tag or image@SHA:012345679abcdef. So, this field also accepts either format.

It is up to the backend to decide if it accepts image:tag or only accepts image@SHA:012345679abcdef format. There are reasons you might chose to do either way, so this API doesn't have an opinion.

Q-Lee · 2016-08-04T20:57:25Z

This is very close. Let's put this and I'll make the remaining changes in a new, narrower PR.

k8s-github-robot · 2016-08-05T20:03:17Z

PR changed after LGTM, removing LGTM. @erictune @philips @soltysh @Q-Lee

k8s-bot · 2016-08-05T20:25:55Z

GCE e2e build/test passed for commit 9d59ae5.

Added image-policy proposal

googlebot added the cla: yes label Jun 9, 2016

k8s-github-robot assigned bgrant0607 Jun 9, 2016

k8s-github-robot added kind/design Categorizes issue or PR as related to design. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. release-note-label-needed labels Jun 9, 2016

ericchiang reviewed Jun 9, 2016
View reviewed changes

erictune force-pushed the imgprov branch from a0343bf to 790ab49 Compare June 9, 2016 17:50

erictune mentioned this pull request Jun 9, 2016

Ensuring only images are from approved sources are run #22888

Closed

smarterclayton reviewed Jun 9, 2016
View reviewed changes

dchen1107 mentioned this pull request Jun 10, 2016

Integration test is broken due to swagger-checker breakage #27205

Closed

erictune force-pushed the imgprov branch from 790ab49 to 1217120 Compare June 14, 2016 06:21

smarterclayton mentioned this pull request Jun 14, 2016

Add a generic admission controller that uses JSONPath for rules. #27336

Closed

alex-mohr reviewed Jun 21, 2016
View reviewed changes

erictune force-pushed the imgprov branch from 1217120 to 4a60be8 Compare June 21, 2016 16:23

bgrant0607 reviewed Jun 22, 2016
View reviewed changes

bgrant0607 assigned smarterclayton and unassigned bgrant0607 Jun 23, 2016

erictune unassigned smarterclayton Jul 23, 2016

philips mentioned this pull request Jul 23, 2016

Container Image Policy kubernetes/enhancements#59

Closed

21 tasks

philips reviewed Jul 23, 2016
View reviewed changes

erictune force-pushed the imgprov branch from 9136f7c to 2ae1770 Compare July 25, 2016 23:43

jzelinskie reviewed Jul 27, 2016
View reviewed changes

k8s-github-robot added the do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. label Jul 28, 2016

ericchiang reviewed Aug 3, 2016
View reviewed changes

erictune force-pushed the imgprov branch from 2ae1770 to bfd1305 Compare August 3, 2016 23:00

Q-Lee reviewed Aug 3, 2016
View reviewed changes

Q-Lee added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 4, 2016

Added image-provenance proposal

9d59ae5

erictune force-pushed the imgprov branch from bfd1305 to 9d59ae5 Compare August 5, 2016 19:50

k8s-github-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 5, 2016

erictune added the e2e-not-required [deprecated use retest-not-required] label Aug 5, 2016

erictune merged commit 6f0bc85 into kubernetes:master Aug 5, 2016

zhouhaibing089 mentioned this pull request Aug 15, 2016

Image Signing Support #30603

Closed

xingzhou pushed a commit to xingzhou/kubernetes that referenced this pull request Dec 15, 2016

Merge pull request kubernetes#27129 from erictune/imgprov

8a85b8c

Added image-policy proposal

erictune deleted the imgprov branch August 8, 2017 18:16


		## Admission controller

		An `ImagePolicyWebhook` admission controller will be written. The admission controller examines all pod objects which are

Added image-policy proposal #27129

Added image-policy proposal #27129

Conversation

erictune commented Jun 9, 2016

erictune commented Jun 9, 2016

erictune commented Jun 9, 2016

erictune commented Jun 9, 2016

ericchiang Jun 9, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

erictune commented Jun 9, 2016

ericchiang commented Jun 9, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

erictune commented Jun 13, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

erictune commented Jul 23, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

erictune commented Jul 25, 2016

smarterclayton commented Jul 26, 2016 via email

philips commented Jul 27, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jzelinskie Jul 31, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Q-Lee commented Aug 4, 2016

k8s-github-robot commented Aug 5, 2016

k8s-bot commented Aug 5, 2016

ericchiang Jun 9, 2016 •

edited

Loading

jzelinskie Jul 31, 2016 •

edited

Loading