Container Service for Kubernetes:Verify container image signatures with kritis-validation-hook

Prerequisites

• Security Center is activated:

  • Subscription: Ultimate (If your current edition does not support this feature, upgrade).

  • Pay-as-you-go: Host and Container Security pay-as-you-go is activated (If not activated, purchase).

• Create a KMS key that uses an asymmetric encryption algorithm. For more information, see Manage keys.

  Important

  Container signing requires an asymmetric key. When creating the KMS key, set Key Type to RSA_2048 and Key Usage to Sign/Verify. For more information about KMS key algorithms, see Key Management Service overview.

• An ACR Enterprise Edition instance with the Advanced specification is available.

Step 1: Install kritis-validation-hook

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Components and Add-ons .

3. On the Add-ons page, click the Security tab, find kritis-validation-hook, and then click Install.

4. Grant the permissions required to access the kritis-validation-hook add-on.

   Ensure that the cluster has the required permissions to run the kritis-validation-hook component. For more information, see Configure access permissions for resources.

Step 2: Create a KMS key for image signing

To create a Customer Master Key (CMK), see Manage keys.

Step 3: Create a witness in Security Center

1. Log on to the Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Signature.

3. On the Witness tab, click Create Witness. After configuring the parameters, click OK.

   Parameter	Description
   Witness Name	When configuring a container signing security policy, a witness is selected to provide trusted authorization for container images. Use a descriptive name.
   Select Certificate	From the certificate list, select the KMS key created earlier.
   Description	Enter a description for the witness.

Step 4: Enable automatic image signing in ACR

1. Log on to the Container Registry console.

2. In the top navigation bar, select a region.

3. In the left-side navigation pane, click Instances.

4. On the Instance page, find the Enterprise Edition instance and click its name, or click Manage in the Actions row.

   Note

   To create an Enterprise Edition instance, click Create ACR EE. Set Specification to Advanced.

5. In the left-side navigation pane of the instance details page, choose Repository > Namespaces.

   Create a namespace to enable image signing for all container images in the namespace. For more information, see Basic operations on namespaces.

6. Enable automatic image signing for the namespace created earlier.

   When adding a signature rule, select the witness created in Security Center in Step 3.

   1. In the left-side navigation pane of the instance details page, choose Security and Trust > Image Signature .

   2. On the Image Signature tab, click Create a signature rule.

      For more information, see Configure a rule for automatic image signing.

Step 5: Enable signature verification in Security Center

Create and enable a security policy in Security Center to enforce container image signature verification for a specific Kubernetes namespace.

1. Log on to the Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Signature.

3. On the Security Policy tab, click Create Policy. After configuring the policy, click OK.

   Parameter	Description
   Policy Name	When you configure a signature security policy, you must select a witness to grant trusted authorization to your target cluster. Enter a descriptive policy name that is easy to identify.
   Witness	Select the witness created earlier.
   Application Cluster	Click the cluster group that requires signature verification, and select the target Cluster Namespace.
   Policy Status	Enable this option to activate the policy immediately. Note The policy is disabled by default. A policy does not take effect unless you enable it.
   Description	Enter a description for the security policy.

Step 6: Verify automatic signature verification

Run the following commands to verify that signature verification is working as expected.

• In the namespace where signature verification is enabled, attempts to deploy unsigned container images are rejected.

  Use a tag-formatted image reference:

  kubectl -n default create deployment not-sign --image=alpine:3.11 -- sleep 10

  Error from server: admission webhook "kritis-validation-hook-deployments.grafeas.io" denied the request: image alpine:3.11 is not attested

  Use a digest-formatted image reference:

  kubectl -n default create deployment not-sign --image=alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 -- sleep 10

  Error from server: admission webhook "kritis-validation-hook-deployments.grafeas.io" denied the request: image alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 is not attested

• Push an image to the ACR namespace where automatic signing is enabled, and then verify that the signed container image can be deployed.

  docker push kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine:3.11

  The push refers to repository [kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine]
  5216338b40a7: Pushed
  3.11: digest: sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 size: 528

  Deploy the automatically signed container image:

  kubectl -n default create deployment is-signed --image=kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 -- sleep 10

  deployment.apps/is-signed created

Related documents

• For an overview of the kritis-validation-hook component, see kritis-validation-hook component overview.

• For the release notes of the kritis-validation-hook component, see kritis-validation-hook.