OpenShift native signatures #14
Conversation
mtrmac
force-pushed
the
openshift-native-signatures
branch
from
0c44ed5 to
653fd7a
Compare
| // SignedClaims map[string]string `json:"signedClaims,omitempty"` | ||
| // Created *unversioned.Time `json:"created,omitempty"` | ||
| // IssuedBy SignatureIssuer `json:"issuedBy,omitempty"` | ||
| // IssuedTo SignatureSubject `json:"issuedTo,omitempty"` |
There was a problem hiding this comment.
What's up with all of these commented out fields? Something to be used in the future?
There was a problem hiding this comment.
Those fields exist in the upstream OpenShift objects, and we do not use them (In particular these should be filled in by the server, to have something to display in an UI, so we want to neither fill them in (the server will override that) nor read them (we want to make independent policy decisions without trusting the server)).
This ~ only acknowledges their existence, and unlike uncommented fields we do not need to define the used types etc.
mtrmac
force-pushed
the
openshift-native-signatures
branch
4 times, most recently
from
b3f068a to
ea18e1e
Compare
mtrmac
force-pushed
the
openshift-native-signatures
branch
3 times, most recently
from
fc7b499 to
a2e8c82
Compare
mtrmac
force-pushed
the
openshift-native-signatures
branch
2 times, most recently
from
27c8657 to
3ebb1e8
Compare
mtrmac
force-pushed
the
openshift-native-signatures
branch
2 times, most recently
from
321ab65 to
9a6b762
Compare
|
Updated against the final merged API from openshift/origin#9181 . I'm afraid this still requires a cluster-wide signature privilege, but it does work and it is hopefully already useful. |
|
See also containers/skopeo#93 for the necessary |
Read imagestreamimage to read signatures. Add signatures one by one. The signatures are shared for a single image across any namespaces, so we don’t delete (others’) signatures. Note that this currently requires a cluster-wide signature write privilege, system:image-signer! A minimal configuration to make this work, though leaving permissions wide open, is > oadm policy add-cluster-role-to-group system:image-signer system:authenticated Signed-off-by: Miloslav Trmač <[email protected]>
mtrmac
force-pushed
the
openshift-native-signatures
branch
from
9a6b762 to
f1bc742
Compare
|
lgtm |
Actually it does, because even |
|
👍 |
4 participants
This adds support for storing signatures in Atomic Registry, assuming server-side support per (merged) openshift/origin#8371 and (currently unmerged) openshift/origin#9181 .
(Marked as WIP because the server side is missing, and because this currently requires a cluster-wide “update signatures” privilege, which seems impractical, so future changes of the API cannot be ruled out. Also, this is currently done as 2 commits to preserve the 2 possible ways to upload signatures, after the decisions are final they should be squashed.)