Security Center:Container image signing

Version Limits

• Subscription: Ultimate (If your current edition does not support this feature, upgrade).

  Note

  The protection edition of the server must be set to the edition you purchased. For more information, see Bind a server protection edition.

• Pay-as-you-go: Host and Container Security pay-as-you-go is activated (If not activated, purchase).

  Note

  The server protection level must be set to Host and Container Security. For more information, see Bind a server protection level.

Prerequisites

• A KMS key created with an asymmetric key algorithm. For more information, see Manage keys.

  Note

  Container image signing requires asymmetric key algorithms. When you create a KMS key, set Select Certificate to RSA_2048, and set Purpose to SIGN/VERIFY. For more information about KMS key algorithms, see KMS-supported algorithm specifications.

• A Kubernetes cluster is created and the kritis-validation-hook component is installed in the cluster.

  Note

  For more information see Create an ACK dedicated cluster (discontinued),Introduction to the kritis-validation-hook component.

• If you are using container image signing for the first time, complete cloud asset access authorization. In the Security Center console, select Container Image Signing and click Authorize.

Procedure

1. Log on to the Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Image Signing.

3. Optional:On the Witness tab, create an attestor.

   If you have already created an attestor, skip this step.

   On the Witness tab, click Create Witness. Configure the settings and click OK.

   Parameter	Description
   Attestor Name	The name of the attestor to select when you configure a container image signing security policy for trusted authorization of target containers. Use a descriptive name.
   Certificate	Select a KMS key that you created from the certificate list.
   Description	Enter a description of the attestor.

4. On the Security Policy tab, click Create Policy. Configure the parameters and click OK.

   Parameter	Description
   Policy Name	When you configure a signing security policy, select an attestor for trusted authorization of your target cluster. Use a descriptive name.
   Attestor	Select an attestor that you created from the attestor list.
   Cluster	Click the cluster group that requires container image signing, and then select the target Cluster Namespace.
   Policy Status	Turn on the switch to enable the policy immediately after creation. Note The policy is disabled by default. A disabled policy does not take effect.
   Note	Enter a description of the security policy.

   After you create and enable a container image signing security policy, container images with the policy enabled are labeled Signed in the Container Registry console.

References

You can use Container Registry (ACR), Key Management Service (KMS), the kritis-validation-hook component, and Security Center together to automatically verify container image signatures. This ensures that only images signed by trusted parties are deployed, reducing the risk of unexpected or malicious code in your environment. For more information, see Verify container image signatures with kritis-validation-hook.