Codestin Search App

sjhx · 2020-02-24T13:14:39Z

#70

helm/portieris/Chart.yaml

helm/portieris/values.yaml

pkg/controller/multi/controller.go

pkg/verifier/simple/imagePolicy.go

pkg/verifier/simple/imagePolicy_test.go

sjhx · 2020-03-24T09:46:12Z

I think this represents a reasonable initial release of support for RedHat simple signatures with follow on issues to make incremental improvements, e.g. we should have a README to describe the policy options for simple.

molepigeon · 2020-03-26T11:10:15Z

README.md

 ## How it works

-Portieris uses a Kubernetes Mutating Admission Webhook to modify your Kubernetes resources at the point of creation, to ensure that Kubernetes pulls the signed version. When configured to do so, it enforces trust pinning, and blocks the creation of resources that use untrusted images.
+Portieris uses a Kubernetes Mutating Admission Webhook to modify your Kubernetes resources at the point of creation, to ensure that Kubernetes runs only policy compliant images. When configured to do so, it can enforce Docker Content Trust with optional trust pinning, or can verify signatures created using RedHat's simple signing model and will prevent the creation of resources using untrused or unverified images.


typo: untrused

molepigeon · 2020-03-26T11:11:42Z

README.md

+When you create or edit a workload, the Kubernetes API server sends a request to Portieris. The AdmissionRequest contains the content of your workload. For each image in your workload, Portieris finds a matching security policy.
+If trust enforcement is enabled in the policy, Portieris pulls signature information for your image from the corresponding Notary server and, if a signed version of the image exists, creates a JSON patch to edit the image name in the workload to the signed image by digest. If a signer is defined in the policy, Portieris additionally checks that the image is signed by the specified role, and verifies that the specified key was used to sign the image.
+If simple signing is specified by the policy, Portieris will verify the signature using using the public key and identity rules supplied in the policy and if verified similarly mutates the image name to a digest referencee to ensure that concurrent tag changes cannot influence the image being puuled.
+While it is possible to require both DCT and Simple signing, alternatives are *not* allowed, if both are required conflicting digests will cause the image to be denied. 


Did you want to put each of these sentences on their own line? If so, you need to put another newline between them - at the moment this renders to one block of text as before.

molepigeon · 2020-03-26T11:12:07Z

README.md

-When you create or edit a workload, the Kubernetes API server sends a request to Portieris. The AdmissionRequest contains the content of your workload. For each image in your workload, Portieris finds a matching security policy. If trust enforcement is enabled in your policy, Portieris pulls signature information for your image from the corresponding Notary server and, if a signed version of the image exists, creates a JSON patch to edit the image name in the workload to the signed image by digest. If a signer is defined in the policy, Portieris additionally checks that the image is signed by the specified role, and verifies that the specified key was used to sign the image.
+When you create or edit a workload, the Kubernetes API server sends a request to Portieris. The AdmissionRequest contains the content of your workload. For each image in your workload, Portieris finds a matching security policy.
+If trust enforcement is enabled in the policy, Portieris pulls signature information for your image from the corresponding Notary server and, if a signed version of the image exists, creates a JSON patch to edit the image name in the workload to the signed image by digest. If a signer is defined in the policy, Portieris additionally checks that the image is signed by the specified role, and verifies that the specified key was used to sign the image.
+If simple signing is specified by the policy, Portieris will verify the signature using using the public key and identity rules supplied in the policy and if verified similarly mutates the image name to a digest referencee to ensure that concurrent tag changes cannot influence the image being puuled.


typos: referencee, puuled

molepigeon · 2020-03-26T11:14:31Z

README.md

+When you create or edit a workload, the Kubernetes API server sends a request to Portieris. The AdmissionRequest contains the content of your workload. For each image in your workload, Portieris finds a matching security policy.
+If trust enforcement is enabled in the policy, Portieris pulls signature information for your image from the corresponding Notary server and, if a signed version of the image exists, creates a JSON patch to edit the image name in the workload to the signed image by digest. If a signer is defined in the policy, Portieris additionally checks that the image is signed by the specified role, and verifies that the specified key was used to sign the image.
+If simple signing is specified by the policy, Portieris will verify the signature using using the public key and identity rules supplied in the policy and if verified similarly mutates the image name to a digest referencee to ensure that concurrent tag changes cannot influence the image being puuled.
+While it is possible to require both DCT and Simple signing, alternatives are *not* allowed, if both are required conflicting digests will cause the image to be denied. 


Perhaps:

While it is possible to require both Notary and simple signing, the two methods must agree on the signed digest for the image. If the two methods return different signed digests, the image is denied.

molepigeon · 2020-03-26T11:15:55Z

pkg/controller/multi/controller.go

 				// convert digest to patch
 				glog.Infof("Mutation #: %s %d  Image name: %s", containerType, containerIndex, img.String())
 				if strings.Contains(container.Image, img.String()) {
+					// TODO: seems odd to have both tag and digest


it is a TODO and should be investigated, it is not a change from master, would an issue be better?

made an issue #90

molepigeon · 2020-03-26T11:16:55Z

pkg/kubernetes/secret.go

+	if key, ok := secret.Data["key"]; ok {
+		return key, nil
+	}
+	return nil, fmt.Errorf("Secret %q in %q does not contain a \"key\" attribte", secretName, namespace)


typo: attribte

molepigeon · 2020-03-26T11:19:05Z

pkg/verifier/simple/imagePolicy_test.go

+				assert.Contains(t, err.Error(), tt.errMsg, "unexpected error")
+			} else {
+				assert.NoError(t, err)
+				//assert.Equal(t, tt.wantList, got)


Is this commented out intentionally?

deleted is better

* save * wip-save * unused * wip-2 * wip * wip * pr check * makefile fmt * no dep on gpgme * vet * fix test invoke * trust and simple concurrenltly * review issues * ease local testing * improve ut tests * e2e.simple * README less DCT specific * multiple simple policies and tests * keys from secrets * doc typos, code cleanliness

sjhx added 13 commits February 2, 2020 21:53

save

de714f3

wip-save

d333317

unused

20bca64

wip-2

9b4927b

wip

5257e88

wip

7c46ef0

pr check

dcafd6c

makefile fmt

6e508a9

no dep on gpgme

a2e6449

vet

01c9ecb

merge master

9e4c40e

fix test invoke

cf61549

trust and simple concurrenltly

772f642

molepigeon reviewed Mar 4, 2020

View reviewed changes

sjhx added 7 commits March 16, 2020 15:37

review issues

48f714d

ease local testing

bdbf14f

improve ut tests

2131756

e2e.simple

ab8e642

README less DCT specific

d6d81bb

multiple simple policies and tests

47c12a4

keys from secrets

f28eabd

sjhx marked this pull request as ready for review March 23, 2020 21:16

molepigeon requested changes Mar 26, 2020

View reviewed changes

doc typos, code cleanliness

3426543

molepigeon approved these changes Mar 26, 2020

View reviewed changes

molepigeon merged commit 8a5adaf into master Mar 26, 2020

molepigeon deleted the atomic2 branch March 26, 2020 12:25

Conversation

sjhx commented Feb 24, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sjhx commented Mar 24, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sjhx commented Feb 24, 2020 •

edited

Loading