Skip to content

v0.1.0

Choose a tag to compare

View all tags
@saschagrunert saschagrunert released this 22 Jul 15:23
v0.1.0
2f4d6c6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Initial release of the Supply Chain NRI Plugin, an NRI plugin that verifies container image supply chain attestations at the runtime level.

Highlights

  • Runtime-level enforcement: Intercepts container creation on CRI-O and containerd, so verification cannot be bypassed by misconfigured admission webhooks or direct kubelet API calls
  • Attestation verification: Verifies SLSA provenance, VEX advisories, and VSA attestations using Sigstore bundle verification
  • Policy-based rules: Configurable per namespace and image pattern with glob matching and regex support
  • Cosign compatibility: Tag-based attestation discovery with OCI registry fallback
  • Standalone CLI: Verify images outside of a cluster with nri-supply-chain --verify-image
  • Live config reloading: Watches config files via fsnotify, applies policy changes without restart
  • Observability: Prometheus metrics for verification latency, cache hit rates, and error counts; structured audit logging
  • Verification result caching: In-memory TTL cache with pre-warming support to reduce registry round-trips

Installation

Method Artifact
Container image ghcr.io/saschagrunert/nri-supply-chain:0.1.0
Binary nri-supply-chain_0.1.0_linux_{amd64,arm64}
Debian package nri-supply-chain_0.1.0_linux_{amd64,arm64}.deb
RPM package nri-supply-chain_0.1.0_linux_{amd64,arm64}.rpm
Kubernetes daemonset.yaml
systemd nri-supply-chain.service

All binaries are signed with cosign and include SBOM artifacts. See Verifying Releases for verification steps.

Full Changelog: https://github.com/saschagrunert/nri-supply-chain/commits/v0.1.0

Assets 16
Loading