cosign-gatekeeper-provider

KO | EN

gitlite — search

#python #hacktoberfest #typescript #llm #golang #go #macos #java #awesome #cli #pytorch #mcp #ios #open-source

cosign-gatekeeper-provider

(★ 79)

🔮 ✈️ to integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying their signatures

파일 탐색기

최종 버전 다운로드 (.zip)

- - build.yml
  - check-headers.yml
  - golangci-lint.yml
  - release.yml
  - test.yml
- dependabot.yml
- deployment.yaml
- provider.yaml
- service.yaml
- - error.yaml
  - valid.yaml
- constraint.yaml
- template.yaml
.gitignore
.golangci.yml
.goreleaser.yml
go.mod
go.sum
LICENSE
mageFile.go
provider.go
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# cosign-gatekeeper-provider

## Status

This project has been archived; an alternative project which is interoperable with Sigstore's Public Good Infrastructure is [https://github.com/github/artifact-attestations-opa-provider](https://github.com/github/artifact-attestations-opa-provider).

## Overview

To integrate [OPA Gatekeeper's new ExternalData feature](https://open-policy-agent.github.io/gatekeeper/website/docs/externaldata) with [cosign](https://github.com/sigstore/cosign) to determine whether the images are valid by verifying its signatures.

> This repo is meant for testing Gatekeeper external data feature. Do not use for production.

## Installation

- Deploy Gatekeeper with external data enabled (`--enable-external-data`)
```sh
helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
helm install gatekeeper/gatekeeper  \
    --name-template=gatekeeper \
    --namespace gatekeeper-system --create-namespace \
    --set enableExternalData=true \
    --set controllerManager.dnsPolicy=ClusterFirst,audit.dnsPolicy=ClusterFirst \
    --version 3.10.0
```
_Note: This repository is currently only working with Gatekeeper 3.10 and the `externalData` feature in `alpha`. There is an open issue to track the support of Gatekeeper 3.11 and `externalData` feature in `beta`: https://github.com/sigstore/cosign-gatekeeper-provider/issues/20._

Let's install the `cosign-gatekeeper-provider`:

- `kubectl apply -f manifest`

- `kubectl apply -f manifest/provider.yaml`
  > Update `url` if it's not `http://cosign-gatekeeper-provider.cosign-gatekeeper-provider:8090` (default)

- `kubectl apply -f policy/template.yaml`

- `kubectl apply -f policy/constraint.yaml`

## Verification

To test this successfully, we should sign one of our images with [cosign](https://github.com/sigstore/cosign#installation) tool. So, let's do this first:

Generate key pair
```shell
$ cosign generate-key-pair
```

We have two files under `policy/examples`, one for valid manifest that contains signed image, the other is invalid. To do the same you should sign your image as I did:

```shell
$ crane copy alpine:latest devopps/alpine:signed
$ crane copy alpine:3.14 devopps/alpine:unsigned
$ cosign sign --key cosign.key devopps/signed:latest
```

So, once you are ready, let's apply these manifests one by one. It should allow deploying Pod for valid.yaml, and deny for the other one.

cosign-gatekeeper-provider

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

cosign-gatekeeper-provider

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README