Run only the images you trust
With MKE you can force applications to use only images that are signed by MKE users you trust. Every time a user attempts to deploy an application to the cluster, MKE verifies that the application is using a trusted image. If a trusted image is not in use, MKE halts the deployment.
By signing and verifying the images, you ensure that the images in use in your cluster are trusted and have not been altered, either in the image registry or on their way from the image registry to your MKE cluster.
Important
Deprecation of Docker Content Trust (DCT)
Docker Content Trust (DCT) use is deprecated and will be removed in a future MKE release. To prevent future cluster admission disruptions, Mirantis strongly recommends that you migrate your signature verification workflows to Cosign.
You can only have one active trust provider enabled at a time. The MKE configuration validator actively blocks configurations in which Cosign image verification and the deprecated legacy DCT are simultaneously enabled.
Image signature enforcement workflow
The following workflow shows how image signature enforcement fits into a typical development and deployment pipeline:
Step |
Detail |
|---|---|
1 |
A developer makes changes to a service and pushes their changes to a version control system. |
2 |
A CI system creates a build, runs tests, and pushes an image to the Mirantis Secure Registry (MSR) with the new changes. |
3 |
The QA team pulls the image, runs more tests, and, if verification passes, signs and pushes the image. |
4 |
IT operations deploys the service, but only if the image in use is signed by the QA team. Otherwise, MKE will not deploy. |
Allow running services that only use Docker trusted images
Configure MKE so that it only deploys Docker trusted images:
Log in to the MKE web UI.
In the left-side navigation menu, click the user name drop-down to display the available options.
Navigate to Admin Settings > Signature Enforcement to reveal the Signature Enforcement page.
Select the provider you want from the Verification provider list.
Enable Run only signed images.
Important
At this point, MKE allows the deployment of any signed image, regardless of signee.
(Optional) Make it necessary for the image to be signed by a particular team or group of teams:
Click Add Team+ to reveal the two-part tool.
From the drop-down at the left, select an organization.
From the drop-down at the right, select a team belonging to the organization you selected.
Repeat the procedure to configure additional teams.
Note
If you specify multiple teams, the image must be signed by a member of each team, or someone who is a member of all of the teams.
Click Save.
MKE immediately begins enforcing the image trust policy. Existing services continue to run and you can restart them as necessary. From this point, however, MKE only allows the deployment of new services that use a trusted image.
Switch verification providers
You can switch between verification providers without having to recreate your existing team configuration. When switching providers, MKE automatically copies the current organization and team configuration to the newly selected provider.
Log in to the MKE web UI.
In the left-side navigation menu, click the user name drop-down to display the available options.
Navigate to Admin Settings > Signature Enforcement to reveal the Signature Enforcement page.
Select a different provider from the Verification provider list.
Review the confirmation dialog.
Click OK to confirm the provider switch.
Review the imported organization and team configuration.
Modify the configuration as necessary.
Click Save.
Disable image signature enforcement
To skip image signature verification during deployment operations, disable signature enforcement:
Log in to the MKE web UI.
In the left-side navigation menu, click the user name drop-down to display the available options.
Navigate to Admin Settings > Signature Enforcement to reveal the Signature Enforcement page.
Select None from the Verification provider list.
Click Save.