Container Service for Kubernetes:Verify container image signatures with kritis-validation-hook

Prerequisites

• Security Center is activated:

  • Subscription: Ultimate (if your edition does not support this feature, performupgrade).

  • Pay-as-you-go:ActivatedHost and Container Securitypay-as-you-go (if not activated, go topurchase).

• Create a KMS key that uses an asymmetric encryption algorithm. For more information, see Manage keys.

  Important

  Container signing requires an asymmetric key. When you create the KMS key, you must set Key Type to RSA_2048 and Key Usage to Sign/Verify. For more information about KMS key algorithms, see Key Management Service overview.

• You must have an ACR Enterprise Edition instance with the Advanced specification.

Step 1: Install kritis-validation-hook

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Components and Add-ons.

3. On the Add-ons page, click the Security tab, find kritis-validation-hook, and then click Install.

4. Grant the kritis-validation-hook component the required permissions.

   You must ensure that the cluster has the required permissions to run the kritis-validation-hook component. For more information, see Configure access permissions for resources.

Step 2: Create a KMS key for image signing

For instructions on how to create a Customer Master Key (CMK), see Manage keys.

Step 3: Create a witness in Security Center

1. Log on to the Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Image Signing.

3. On the Witness tab, click Create Witness. After you configure the parameters, click OK.

   Parameter	Description
   Witness Name	A witness is selected when you configure a security policy to authorize your container images. We recommend that you specify a name that is easy to identify.
   Select Certificate	From the certificate list, select the KMS key that you created.
   Description	Enter a description for the witness.

Step 4: Enable automatic image signing in ACR

1. Log on to the Container Registry console.

2. In the top navigation bar, select a region.

3. In the left-side navigation pane, click Instances.

4. On the Instance page, find the Enterprise Edition instance and click its name, or click Manage in the Actions column.

   Note

   To create an Enterprise Edition instance, click Create ACR EE. Make sure that you set Specification to Advanced.

5. In the left-side navigation pane of the instance details page, choose Repository > Namespaces.

   Create a namespace. You can enable image signing for all container images in this namespace. For more information, see Basic operations on namespaces.

6. Enable automatic image signing for the namespace you created.

   When you add a signature rule, select the witness that you created in Security Center in Step 3.

   1. In the left-side navigation pane of the instance details page, choose Security and Trust > Image Signature .

   2. On the Image Signature tab, click Create a signature rule.

      For more information about how to configure a signature rule, see Configure a rule for automatic image signing.

Step 5: Enable signature verification in Security Center

Create and enable a security policy in Security Center to enforce container image signature verification for a specific Kubernetes namespace.

1. Log on to the Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Image Signing.

3. On the Security Policy tab, click Add Policy. After you configure the policy, click OK.

   Parameter	Description
   Policy Name	Enter a descriptive name for the security policy.
   Witness	Select the witness that you created.
   Application Cluster	Click the cluster group for which you want to enable signature verification, and select the target Cluster Namespace.
   Policy Status	Enable this option to activate the policy immediately. Note The policy is disabled by default.
   Description	Enter a description for the security policy.

Step 6: Verify automatic signature verification

Run the following commands to verify that signature verification is working as expected.

• In the namespace where signature verification is enabled, attempts to deploy unsigned container images are rejected.

  Use a tag-formatted image reference:

  kubectl -n default create deployment not-sign --image=alpine:3.11 -- sleep 10

  Error from server: admission webhook "kritis-validation-hook-deployments.grafeas.io" denied the request: image alpine:3.11 is not attested

  Use a digest-formatted image reference:

  kubectl -n default create deployment not-sign --image=alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 -- sleep 10

  Error from server: admission webhook "kritis-validation-hook-deployments.grafeas.io" denied the request: image alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 is not attested

• Push an image to the ACR namespace where automatic signing is enabled. Then, verify that you can deploy the signed container image as a workload.

  docker push kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine:3.11

  The push refers to repository [kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine]
  5216338b40a7: Pushed
  3.11: digest: sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 size: 528

  Deploy the automatically signed container image:

  kubectl -n default create deployment is-signed --image=kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 -- sleep 10

  deployment.apps/is-signed created

Related documents

• For an overview of the kritis-validation-hook component, see kritis-validation-hook component overview.

• For the release notes of the kritis-validation-hook component, see kritis-validation-hook.