ImageVerificationConfig fails with Cilium

[michaelbeaumont]

I'm seeing what looks like #13342 with Cilium:

node: 2026/06/23 08:22:09.376252 2026-06-23T08:22:09.376Z DEBUG no bundle referrers found, trying bundle tag {"image_ref": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "image": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"}
node: 2026/06/23 08:22:09.376260 2026-06-23T08:22:09.376Z DEBUG resolving bundle tag {"image_ref": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "image": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "bundleTag": "sha256-20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"}
node: 2026/06/23 08:22:10.305517 2026-06-23T08:22:10.305Z DEBUG bundle tag not found {"image_ref": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "image": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "bundleTag": "sha256-20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "error": "quay.io/cilium/cilium:sha256-20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732: not found"}
node: 2026/06/23 08:22:10.305527 2026-06-23T08:22:10.305Z DEBUG no bundle tag found, falling back to legacy .sig tag {"image_ref": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "image": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732"}
node: 2026/06/23 08:22:10.305533 2026-06-23T08:22:10.305Z DEBUG resolving .sig tag {"image_ref": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "image": "quay.io/cilium/cilium@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", "signatureTag": "sha256-20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732.sig"}
node: 2026/06/23 08:22:10.726034 machined PermissionDenied [/machine.ImageService/Verify] 1.785542172s unary rpc error: code = PermissionDenied desc = image verification failed: no valid signature found: bundle tag not found

with the rule:

  - image: quay.io/cilium/*
    keyless:
      issuer: https://token.actions.githubusercontent.com
      subjectRegex: '^https://github\.com/cilium/cilium/\.github/workflows/build-images-releases\.yaml@refs/tags/v.*$'

in accordance with https://docs.cilium.io/en/stable/configuration/verify-image-signatures/#verify-signed-container-images and the following succeeds:

cosign verify \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            --certificate-identity-regexp="^https://github\.com/cilium/cilium/\.github/workflows/build-images-releases\.yaml@refs/tags/v.*\$" \
      quay.io/cilium/cilium:v1.19.5

I'm running v1.13.4 so the referenced issue should be fixed there.

[smira]

That feels like a bug, converting it to an issue.