{"id":781,"date":"2018-08-19T00:05:53","date_gmt":"2018-08-18T22:05:53","guid":{"rendered":"https:\/\/blog.unetresgrossebite.com\/?p=781"},"modified":"2018-09-02T19:09:16","modified_gmt":"2018-09-02T17:09:16","slug":"signing-and-scanning-docker-images-with-openshift","status":"publish","type":"post","link":"https:\/\/blog.unetresgrossebite.com\/?p=781","title":{"rendered":"Signing and Scanning Docker Images with OpenShift"},"content":{"rendered":"

You may already know Docker images can be signed. Today we would discuss a way to automate images signature, using OpenShift.<\/p>\n

Lately, I stumbled upon a bunch of interesting repositories:<\/p>\n

  • https:\/\/github.com\/redhat-cop\/openshift-image-signing-scanning<\/a>: ansible playbook configuring an OCP cluster, building a base image, setting up a service account and installing a few templates providing with docker images scanning and signing<\/em><\/li>\n
  • https:\/\/github.com\/redhat-cop\/image-scanning-signing-service<\/a>: an optional OpenShift third-party service implementing support for ImageSigningRequest and ImageScanningRequest objects<\/em><\/li>\n
  • https:\/\/github.com\/redhat-cop\/openshift-event-controller<\/a>: sources building an event controller that would watch for new images pushed to OpenShift docker registry<\/em><\/li>\n

    Although these are amazing, I could not deploy them to my OpenShift Origin, due to missing subscriptions and packages.<\/p>\n

  • Generating a GPG keypair on some server (not necessarily related to OpenShift)<\/li>\n
  • Depending on your usecase, we could then want to configure docker to prevent unsigned images from being run on our main OpenShift hosts<\/li>\n
  • Next, we would setup labels and taints identifying the nodes we trust signing images, as well as apply and install a few templates and a base image<\/li>\n

    At which point, you could either install the event-controller Deployment to watch for all your OpenShift internal registry’s images.<\/p>\n

    Or, you could integrate images scanning and signature yourself using the few templates installed, as shown in a sample Jenkinsfile<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

    You may already know Docker images can be signed. Today we would discuss a way to automate images signature, using OpenShift. Lately, I stumbled upon a bunch of interesting repositories: https:\/\/github.com\/redhat-cop\/openshift-image-signing-scanning: ansible playbook configuring an OCP cluster, building a base image, setting up a service account and installing a few templates providing with docker images […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[8,12,10,13,2],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=\/wp\/v2\/posts\/781"}],"collection":[{"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=781"}],"version-history":[{"count":9,"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=\/wp\/v2\/posts\/781\/revisions"}],"predecessor-version":[{"id":792,"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=\/wp\/v2\/posts\/781\/revisions\/792"}],"wp:attachment":[{"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.unetresgrossebite.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}