What would you like to be added?
This issue is for Ratify to provide out-of-box experience in the context of Notary Project signature validation on K8s clusters.
There are three typical scenarios:
- Scenario 1: The k8s workload uses images signed and stored in a public registry.
- Scenario 2: The k8s workload uses images signed and stored in a private registry with certificates stored in AKV
- Scenario 3: The k8s workload uses images signed and stored in a both public and private registry.
After helm installatioin, Ratify should be ready to work. Users should not be required to configure any custom resources by default. For advanced users or any runtime updates, users can update custom resources accordingly based on their needs. Thus, Ratify helm chart should support necessary parameters to set up resources: ORAS Stores, KMP and Notation Verifier.
Scenario 1: As images are stored in a public registry, users can skip the configuration for ORAS store, but able to create the following resources by specifying helm chart values:
- Inline KMPs for storing the PEM formatted public root certificates
- Notation Verifier for setting up Notary Project trust policies
Scenario 2: Users should be able to create the following resource by specifying helm chart values:
- ORAS stores for accessing private registries
- AKV KMPs for accessing certificates stored in AKV
- Notation Verifier for setting up Notary Project trust policies
Scenario 3: Users should be able to create the following resource by specifying helm chart values:
- ORAS stores for accessing private registries
- AKV KMPs for accessing certificates stored in AKV
- inline KMPs for storing the PEM formatted public root certificates
- Notation Verifier for setting up Notary Project trust policies separately for images in public registries and in private registries
Currently, helm chart parameters exist for ORAS stores and KMP resources, but not for Notation Verifier. We need to add parameters for setting up Notation Verifier. The issue #1943 asked for trustedIdentities configuration, but it is not enough, we should allow users to
- set up multiple trust policies
- For each trust policy, users can set up
- RepositoryScopes: a list of repository URLs
- KMPs for trustStores
- trustedIdentities
An example of Notation Verifier parameters will be provided in the issue comment later.
NOTE: This issue does not include the configuration required for setting up admission policies, which could be tracked in another issue for UX improvements.
Anything else you would like to add?
No response
Are you willing to submit PRs to contribute to this feature?
What would you like to be added?
This issue is for Ratify to provide out-of-box experience in the context of Notary Project signature validation on K8s clusters.
There are three typical scenarios:
After helm installatioin, Ratify should be ready to work. Users should not be required to configure any custom resources by default. For advanced users or any runtime updates, users can update custom resources accordingly based on their needs. Thus, Ratify helm chart should support necessary parameters to set up resources: ORAS Stores, KMP and Notation Verifier.
Scenario 1: As images are stored in a public registry, users can skip the configuration for ORAS store, but able to create the following resources by specifying helm chart values:
Scenario 2: Users should be able to create the following resource by specifying helm chart values:
Scenario 3: Users should be able to create the following resource by specifying helm chart values:
Currently, helm chart parameters exist for ORAS stores and KMP resources, but not for Notation Verifier. We need to add parameters for setting up Notation Verifier. The issue #1943 asked for trustedIdentities configuration, but it is not enough, we should allow users to
An example of Notation Verifier parameters will be provided in the issue comment later.
NOTE: This issue does not include the configuration required for setting up admission policies, which could be tracked in another issue for UX improvements.
Anything else you would like to add?
No response
Are you willing to submit PRs to contribute to this feature?