Enhancements

Detail on the enhancements introduced in MKE 3.9.5 includes:

[MKE-13780] Improvements to Client Bundles view in MKE web UI

Update to the Client Bundles view in the MKE web UI, which you can access by clicking the user name to access the Profile page and then clicking Client Bundles. The following information displays for each client bundle:

  • LABEL

  • PUBLIC KEY

  • STATUS (Active, Expired, or Expiring Soon)

  • CREATED

  • EXPIRES

[MKE-13778] Introduction of expired client bundle cleanup function

You can now clean up expired client bundles automatically or on demand, through the MKE configuration file or the MKE web UI. This reduces manual bundle management and helps control RethinkDB storage growth from bundle accumulation.

With this feature you can:

  • View a list of expired client bundles prior to deletion.

  • Perform a dry run, to review expired client bundles marked for deletion.

  • Trigger an immediate cleanup.

  • Schedule automatic cleanup using a cron expression.

[MKE-13678] MKE web UI supports management of Cosign

Update to the Admin Settings → Signature Enforcement MKE web UI page, to support Cosign as the recommended MKE image verification provider. Administrators can now select a verification provider from a dropdown. When they switch between active providers, MKE shows a confirmation modal to preserve existing team configuration.

[MKE-13781] Cosign integration for image trust

MKE now supports Cosign signature verification, which lets administrators enforce image trust policies by cryptographically validating image signatures at admission control, before containers run.

Docker Content Trust (DCT) is now deprecated and will be removed in a future MKE release. MKE enforces mutual exclusivity between the two verification engines — only one can be active at a time. If MKE detects DCT is enabled, it displays a warning banner.