diff --git a/modules/tutorials/pages/enabling_verification_of_image_signatures.adoc b/modules/tutorials/pages/enabling_verification_of_image_signatures.adoc index 6b41b83f0..9bf93ae2a 100644 --- a/modules/tutorials/pages/enabling_verification_of_image_signatures.adoc +++ b/modules/tutorials/pages/enabling_verification_of_image_signatures.adoc @@ -28,6 +28,6 @@ Apply this policy to the cluster by saving it as `kyverno-policy.yaml` and runni kubectl apply -f kyverno-policy.yaml ---- -The policy will be applied to all namespaces in the cluster. It checks all newly created Pods that run any image matching the expression `docker.stackable.tech/*-operator:23.7.*` (all Stackable operators version 23.7.*) and ensures that these images have been signed by a Stackable Github Action from the release 23.7 (`https://github.com/stackabletech/*-operator/.github/workflows/build.yml@refs/tags/23.7.*`). If the signature of an operator image is invalid or missing, the policy will deny the pod creation. +The policy will be applied to all namespaces in the cluster. It checks all newly created Pods that run any image matching the expression `docker.stackable.tech/+++*+++-operator:23.7.+++*+++` (all Stackable operators version 23.7.+++*+++) and ensures that these images have been signed by a Stackable Github Action from the release 23.7 (`https://github.com/stackabletech/+++*+++-operator/.github/workflows/build.yml@refs/tags/23.7.+++*+++`). If the signature of an operator image is invalid or missing, the policy will deny the pod creation. For a more detailed explanation of the policy options, please refer to the https://kyverno.io/docs/writing-policies/verify-images/sigstore/#keyless-signing-and-verification[Kyverno documentation]. -If the `subject` field in the policy is changed to something like `https://github.com/test/*`, the policy will deny the creation of operator pods because the signature is no longer valid. \ No newline at end of file +If the `subject` field in the policy is changed to something like `https://github.com/test/+++*+++`, the policy will deny the creation of operator pods because the signature is no longer valid.