kritis-validation-hook - Container Service for Kubernetes

Configure and test kritis-validation-hook in an ACK cluster to block unsigned container images at admission time, allowing only images signed by a trusted authority and reducing the risk of unexpected or malicious code.

Prerequisites

You need:

An ACK managed cluster or ACK dedicated cluster (Discontinued).

Background

kritis-validation-hook is built on the open source kritisContainer Registry (ACR)Key Management Service (KMS)Security Center software. It integrates with Alibaba Cloud Container Registry (ACR) and verifies images signed with Key Management Service (KMS). With Security Center, KMS, and ACR, it automates image signing and verification for a more secure cluster runtime environment.

See Use the kritis-validation-hook component to automatically verify container image signatures for end-to-end verification.

Configure resource access permissions

The cluster RAM role needs these permissions:

"cr:ListInstance",
"cr:ListMetadataOccurrences"

Important

For ACK managed clusters, grant these permissions to the Worker RAM role. For ACK dedicated clusters, grant them to the Master RAM role and the Worker RAM role.

Add missing permissions as follows.

Create a custom policy with the following content:

{
    "Statement": [
        {
            "Action": [
                "cr:ListInstance",
                "cr:ListMetadataOccurrences"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "1"
}

Grant the policy to the cluster Worker RAM role.

For ACK dedicated clusters, also grant the policy to the Master RAM role.

Enable image signature verification

This example configures image signature verification for the default namespace. Image signing is outside the scope of kritis-validation-hook — this example assumes images are already signed. See Use container image signing for signing steps.

The example uses this signing information. Replace sample values with your own.

Signing information	Example value	How to get	YAML field
KMS public key (Base64)	`LS0tLS1CRUdJTiBQ***`	Create an asymmetric key	`spec.publicKeyData`
KMS key ID	`key-4a2ef103-5aa3-4220-****`	Create a key	`spec.publicKeyId`
Witness name	`demo-aa`	Configure a witness and a signature verification policy	`spec.noteReference` — references witness `demo-aa` via `namespaces/demo-aa`
Signed image	`kritis-demo*.cn-hangzhou.cr.aliyuncs.com/kritis-demo*/alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45`	N/A	N/A

Declare the trusted authority

Create AttestationAuthority.yaml with the following content:

apiVersion: kritis.grafeas.io/v1beta1
kind: AttestationAuthority
metadata:
  name: demo-aa
spec:
  noteReference: namespaces/demo-aa
  publicKeyData: LS0tLS1CRUdJTiBQ***
  publicKeyId: key-4a2ef103-5aa3-4220-****

Apply the resource.

kubectl apply -f AttestationAuthority.yaml

Create a signature verification policy

Create GenericAttestationPolicy.yaml with the following content. The policy references the AttestationAuthority from the previous step.

apiVersion: kritis.grafeas.io/v1beta1
kind: GenericAttestationPolicy
metadata:
  name: demo-gap
spec:
  attestationAuthorityNames:
  - demo-aa

Apply the resource.

kubectl apply -f GenericAttestationPolicy.yaml

Test with an unsigned image

Deploy an unsigned image.

kubectl create deployment test-denied --image=anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6

Expected output:

error: failed to create deployment: admission webhook "kritis-validation-hook-deployments.grafeas.io" denied the request: "ACROpenAPIError detail: <image anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6 is not attested because of get resource url for anolis-registry.cn-zhangjiakou.cr.aliyuncs.com/openanolis/nginx:1.14.1-8.6: ListInstance failed, instanceName: "anolis", regionId: "cn-zhangjiakou", requstURL:error:****

The admission webhook denies the deployment because the image lacks a valid attestation from demo-aa.

Test with a signed image

Deploy a signed image. Replace the image address with yours.

kubectl create deployment test-allow --image=kritis-demo***.cn-hangzhou.cr.aliyuncs.com/kritis-demo***/alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45

Expected output:

deployment.apps/test-allow created

The deployment succeeds because the image is attested by the trusted authority in demo-aa.

Configure an image signature verification allowlist

By default, kritis-validation-hook verifies every container image in its enforcement scope. In middleware or service mesh environments, sidecars injected by third-party components may be unsigned, causing pod creation to fail. Configure an allowlist to skip signature verification for specific images.

Define an admissionallowlists.kritis.grafeas.io resource to specify images that bypass verification.

apiVersion: kritis.grafeas.io/v1beta1   # Default value. Do not modify.
kind: AdmissionAllowlist                # Default value. Do not modify.
metadata:
  name: kritis-allowlist                # Must be unique within the cluster.
spec:
  patterns:                             # Define one or more allowlist entries.
  - namePattern: 'registry*.*.aliyuncs.com/acs/*'
  - namePattern: 'registry-vpc.cn-beijing.aliyuncs.com/arms-docker-repo/*'
    namespace: 'default'    # Optional. If omitted, the entry applies to all namespaces.

namePattern matching rules

Each namePattern value matches the full image reference, including registry host, repository path, and tag or digest. These matching rules apply:

Rule	Description	Example
Exact match	A value without `*` matches only that exact string.	`nginx:v0.1.0` matches only `nginx:v0.1.0`
Trailing `*`	Matches any character except `/`.	`a.com/nginx*` matches `a.com/nginx:v0.1.0` but not `a.com/nginx/test:v0.1.0`
Mid-string `*`	Matches letters, digits, hyphens (`-`), and underscores (`_`).	`registry-vpc.cn-*.aliyuncs.com/acs/pause:3.2` matches both `registry-vpc.cn-hangzhou.aliyuncs.com/acs/pause:3.2` and `registry-vpc.cn-beijing.aliyuncs.com/acs/pause:3.2`

Add ACK system images to the allowlist

Create kritis-admission-allowlist-acs.yaml with the following content:

apiVersion: kritis.grafeas.io/v1beta1
kind: AdmissionAllowlist
metadata:
  name: allow-acs-images
spec:
  patterns:
  - namePattern: 'registry*.*.aliyuncs.com/acs/*'
  - namePattern: 'registry-*.ack.aliyuncs.com/acs/*'

Common allowlist patterns you can add:

# Images used by ACK
- namePattern: 'registry*.*.aliyuncs.com/acs/*'
- namePattern: 'registry-*.ack.aliyuncs.com/acs/*'

# Images used by ACK (China regions only)
- namePattern: 'registry*.cn-*.aliyuncs.com/acs/*'
- namePattern: 'registry-cn-*.ack.aliyuncs.com/acs/*'

# Images used by ARMS
- namePattern: 'registry*.*.aliyuncs.com/arms-docker-repo/*'

# Images used by ARMS (China regions only)
- namePattern: 'registry*.cn-*.aliyuncs.com/arms-docker-repo/*'

Apply the allowlist.

kubectl apply -f kritis-admission-allowlist-acs.yaml

Expected output:

admissionallowlist.kritis.grafeas.io/allow-acs-images created

Verify the allowlist:

kubectl get admissionallowlists.kritis.grafeas.io

Expected output:

NAME               AGE
allow-acs-images   2m22s

Container Service for Kubernetes:Configure kritis-validation-hook to verify container image signatures

Prerequisites

Background

Configure resource access permissions

Enable image signature verification

Declare the trusted authority

Create a signature verification policy

Test with an unsigned image

Test with a signed image

Configure an image signature verification allowlist

namePattern matching rules

Add ACK system images to the allowlist

Next steps