Container Service for Kubernetes:Use kritis-validation-hook to automatically verify container image signatures

Prerequisites

• You have activated Security Center:

  • Subscription service: Ultimate (If your current version is unsupported, you must upgrade).

  • Pay-as-you-go service: The pay-as-you-go service is enabled for Host and Container Security. If not, see Purchase.

• You have created a KMS key that uses an asymmetric key encryption algorithm. For more information, see Manage keys.

  Important

  Because container image signing requires an Asymmetric Key algorithm, you must set Key Specifications to RSA_2048 and Key Usage to SIGN/VERIFY when you create a KMS key. For more information about KMS key algorithms, see KMS Overview.

• ACR instance has to be Premium Edition.

Step 1: Install the kritis-validation-hook component

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, find the cluster you want and click its name. In the left navigation pane, click Add-ons.

3. On the Add-ons page, on the Security tab, find the kritis-validation-hook component and click Install.

4. Grant the required permissions to the kritis-validation-hook component.

   You must grant your cluster the permissions to run kritis-validation-hook. For more information, see Authorize a cluster to access resources.

Step 2: Create a KMS key for container image signing

Create a customer master key (CMK). For more information, see Manage keys.

Step 3: Configure a witness that uses the KMS key in Security Center

1. Log on to the Security Center console.

2. In the left navigation pane, select Protection Configuration > Container Protection > Container Image Signing .

3. On the Witness tab, click Create Witness. Complete the configuration and click OK.

   Configuration item	Note
   Witness Name	When you configure a container image signing security policy, a witness is required to grant trusted authorization to your target containers. Enter a recognizable name for the witness.
   Select Certificate	Select the KMS key that you created from the certificate list.
   Description	Enter the description for the witness.

Step 4: Enable automatic container image signing in ACR

1. Log on to the Container Registry console.

2. In the top navigation bar, select a region.

3. In the left-side navigation pane, click Instances.

4. On the Instances page, click the name of the target Enterprise instance or Manage.

5. In the navigation pane on the left of the Enterprise Instance management page, select Repository > Namespaces.

   You need to create a namespace and enable image signing for images within that namespace. For more information, see Manage namespaces.

6. Enable automatic container image signing for the created namespace.

   When you add a signing rule, select the witness that you created in Step 3 in Security Center.

   1. In the left navigation pane, select Security and Trust > Image Signature.

   2. Click Create a signature rule and complete the configuration.

      For more information about how to configure image signing rules, see Configure automatic image signing rules.

Step 5: Enable container image signature verification in Security Center

Enable container image signature verification for a namespace in a Kubernetes cluster by adding and enabling a policy in Security Center.

1. Log on to the Security Center console.

2. In the left navigation pane, select Protection Configuration > Container Protection > Container Image Signing.

3. On the Security Policy tab, click Create Policy. Configure the policy and click OK.

   Configuration item	Note
   Policy Name	When you configure a signing security policy, you must select a witness to grant trusted authorization to your target cluster. Enter an informative name.
   Witness	Select the witness that you created from the witness list.
   Application Cluster	Click the cluster group for container image signing. Then, select the target Cluster Namespace.
   Policy Status	Turn on the switch. The policy is automatically enabled after it is created. Note The policy is disabled by default. A disabled policy does not take effect.
   Remarks	Enter the description of the security policy.

Step 6: Verify the automatic container image signature verification feature

Run the following commands to verify the automatic container image signature verification feature.

• Verify that the deployment of unsigned container images is denied in the default namespace where signature verification is enabled.

  To specify an image by tag, run the following command:

  kubectl -n default create deployment not-sign --image=alpine:3.11 -- sleep 10

  Error from server: admission webhook "kritis-validation-hook-deployments.grafeas.io" denied the request: image alpine:3.11 is not attested

  To specify an image by digest, run the following command:

  kubectl -n default create deployment not-sign --image=alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 -- sleep 10

  Error from server: admission webhook "kritis-validation-hook-deployments.grafeas.io" denied the request: image alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 is not attested

• Push an image to the Container Registry namespace for which automatic signing is enabled. Then, verify that you can use this signed container image to deploy a service.

  docker push kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine:3.11

  The push refers to repository [kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine]
  5216338b40a7: Pushed
  3.11: digest: sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 size: 528

  The following command successfully deploys the automatically signed container image:

  kubectl -n default create deployment is-signed --image=kritis-demo***.cn-hongkong.cr.aliyuncs.com/kritis-demo***/alpine@sha256:ddba4d27a7ffc3f86dd6c2f92041af252a1f23a8e742c90e6e1297bfa1bc0c45 -- sleep 10

  deployment.apps/is-signed created

References

• For more information about kritis-validation-hook, see Introduction to the kritis-validation-hook component.

• For the release notes for the kritis-validation-hook component, see kritis-validation-hook.