Sign container images #501

puerco · 2022-02-15T20:46:25Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR introduces digital signing into the promoter. The signing flow is enabled by default and will use the default kubernetes service account (krel-trust@k8s-artifacts-prod.iam.gserviceaccount.com).

Signing is controlled by two new flags in kpromo cip:

  --sign                          when true, sign promoted images (default true)
  --signer-account string         service account to use as signing identity (default "krel-trust@k8s-artifacts-prod.iam.gserviceaccount.com")

Image signing involves four steps which begin after promotion. After promoting, kpromo will look for signatures attached to images in the original registry and copy them to the destination registries. It will generate tokens for the signer account to invoke the keyless signing flow. Once the tokens are available, it will sign one of the images and copy the resulting combined signature to the rest of the mirrors (if any).

Which issue(s) this PR fixes:

Part of: kubernetes/release#2383

Special notes for your reviewer:

/assign @justaugustus

Stephen I think this is ready, please take a look when you can!

Does this PR introduce a user-facing change?

`kpromo` now signs container images using the sigstore keyless flow. Signing identity can be specified with a new flag `--signer-account`. In addition, image signing can be enabled/disabled using `--sign`.

puerco · 2022-02-16T02:06:05Z

We need to pass the signer an external identity token, if not the cli will ask the user to follow the OIDC flow from the browser:

Enter the verification code XXXX-XXXX in your browser at: https://oauth2.sigstore.dev/auth/device?user_code=XXX-XXXX

This PR enables that: kubernetes-sigs/release-sdk#42

ameukam · 2022-02-17T16:05:58Z

We need to pass the signer an external identity token, if not the cli will ask the user to follow the OIDC flow from the browser:
Enter the verification code XXXX-XXXX in your browser at: https://oauth2.sigstore.dev/auth/device?user_code=XXX-XXXX
This PR enables that: kubernetes-sigs/release-sdk#42

Do you plan to use Github as an identity provider ?

puerco · 2022-02-23T06:22:56Z

Hey @ameukam sorry, I missed your message last week. No, since we will run everything in GCP the identity will come from GCP service accounts. The idea is that the service account that runs the promoter will impersonate a service account that will eventually do the signing.

I'm thinking that we should have two accounts: One for the actual signing of the artifacts and one that we can impersonate while we run the tests. I still have to decipher which service accounts are working in the promoter and then we need to set permissions and roles for all of them.

Before comparing pre and after snapshots, remove the signature layers to ensure images match. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

In order to ensure the same blobs in all images, we now sign one image of a set of mirrors and replicate the signature to the rest. This avoids signing multiple times, ensure one operation in the transparency log and identical blobs (and therefore digests) whe signing promoted images. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

puerco · 2022-03-15T14:53:34Z

/test pull-cip-e2e

This commit modifies the signature copy to crane and ensures we have the SA token ready if we need to pass it to crane. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

puerco · 2022-03-16T01:23:17Z

/test pull-cip-verify
/test pull-cip-unit-tests

Add OCIManifestSchema1 from GGCR to supported media types to ensure we copy existing images. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

puerco · 2022-03-16T05:37:05Z

I tracked a problem where the staging images were getting wiped out when adding the k8s-org signatures to a problem in cosign. Fixed it here: sigstore/cosign#1616.

Before that PR merges and we pull the commit into our deps, the promoter will copy the signatures from staging but will delete them when re-signing.

At some point, attaching signatures will be performed via OCI reference types or other mechanism. Therefore, we will not be "promoting" the sig/sbom layers, ie copying them by listing them in the manifest. The promoter will verify any signed images, if sigs are found and valid, the signatures will be copied to the newly promoted images before signing them with the K8s-wide signature. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

This commit creates a new option `--signer-account` which defines the service account that the promoter will use to sign promoted images. Signed-off-by: Adolfo García Veytia <adolfo.garcia@uservers.net>

This commit adds a new `--sign` flag to `kpromo cip` that allows to enable disable signing of container images. Signed-off-by: Adolfo García Veytia <adolfo.garcia@uservers.net>

Signed-off-by: Adolfo García Veytia <adolfo.garcia@uservers.net>

puerco · 2022-03-21T05:54:09Z

/hold cancel

saschagrunert

Great work! I'll not block in my two findings.

saschagrunert · 2022-03-21T08:26:48Z

internal/promoter/image/sign.go

+	)
+	srcRef, err := name.ParseReference(sourceRefStr)
+	if err != nil {
+		return fmt.Errorf("parsing reference %q: %w", sourceRefStr, err)


non-blocking nit: either use consistently errors.Wrap or wrapping with %w.

saschagrunert · 2022-03-21T08:27:54Z

internal/promoter/image/sign.go

+			gopts.WithCredentialsFile(opts.SignerInitCredentials),
+		}
+	}
+	ctx := context.Background()


non-blocking nit: consider using a context with timeout here.

k8s-ci-robot · 2022-03-21T08:28:57Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: puerco, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [puerco,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot requested review from jimangel and onlydole February 15, 2022 20:46

puerco mentioned this pull request Feb 16, 2022

Signer: Support external OIDC tokens. Fail early if token missing. kubernetes-sigs/release-sdk#42

Merged

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 16, 2022

puerco force-pushed the sign-images branch from c777110 to 830b00d Compare February 17, 2022 16:00

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 17, 2022

puerco force-pushed the sign-images branch from 830b00d to 1698cab Compare February 22, 2022 17:42

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Feb 22, 2022

puerco mentioned this pull request Feb 23, 2022

Implement container image signing MVP (KEP-3031) kubernetes/release#2383

Closed

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 23, 2022

puerco force-pushed the sign-images branch 6 times, most recently from e588d4d to df609be Compare February 23, 2022 07:37

puerco added 2 commits March 12, 2022 18:27

Remove sig layers before comparin snapshots

64b5f75

Before comparing pre and after snapshots, remove the signature layers to ensure images match. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

puerco force-pushed the sign-images branch from 5263d5c to 147e9b4 Compare March 13, 2022 00:27

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Mar 13, 2022

Switch sig copy to crane, prepare token

e3eefa2

This commit modifies the signature copy to crane and ensures we have the SA token ready if we need to pass it to crane. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

Add OCI manifest v1 to supported media types

307be77

Add OCIManifestSchema1 from GGCR to supported media types to ensure we copy existing images. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

puerco added 4 commits March 16, 2022 21:38

Skip signing SBOMs and Signatures

1128d11

Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

Move signing identity to options

a067c3c

This commit creates a new option `--signer-account` which defines the service account that the promoter will use to sign promoted images. Signed-off-by: Adolfo García Veytia <adolfo.garcia@uservers.net>

Add flag to enable/disable signing

c83ada9

This commit adds a new `--sign` flag to `kpromo cip` that allows to enable disable signing of container images. Signed-off-by: Adolfo García Veytia <adolfo.garcia@uservers.net>

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 21, 2022

puerco force-pushed the sign-images branch from 71d8b9a to 6d312a7 Compare March 21, 2022 04:59

Regenerate fakes

5e4bc0a

Signed-off-by: Adolfo García Veytia <adolfo.garcia@uservers.net>

puerco force-pushed the sign-images branch from 6d312a7 to 5e4bc0a Compare March 21, 2022 05:09

puerco changed the title ~~WIP Sign container images~~ Sign container images Mar 21, 2022

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 21, 2022

saschagrunert approved these changes Mar 21, 2022

View reviewed changes

k8s-ci-robot assigned saschagrunert Mar 21, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 21, 2022

k8s-ci-robot merged commit 7096c35 into kubernetes-sigs:main Mar 21, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sign container images #501

Sign container images #501

puerco commented Feb 15, 2022 •

edited

Loading

puerco commented Feb 16, 2022

ameukam commented Feb 17, 2022

puerco commented Feb 23, 2022

puerco commented Mar 15, 2022

puerco commented Mar 16, 2022

puerco commented Mar 16, 2022

puerco commented Mar 21, 2022

saschagrunert left a comment

saschagrunert Mar 21, 2022

saschagrunert Mar 21, 2022

k8s-ci-robot commented Mar 21, 2022

Sign container images #501

Sign container images #501

Conversation

puerco commented Feb 15, 2022 • edited Loading

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

puerco commented Feb 16, 2022

ameukam commented Feb 17, 2022

puerco commented Feb 23, 2022

puerco commented Mar 15, 2022

puerco commented Mar 16, 2022

puerco commented Mar 16, 2022

puerco commented Mar 21, 2022

saschagrunert left a comment

Choose a reason for hiding this comment

saschagrunert Mar 21, 2022

Choose a reason for hiding this comment

saschagrunert Mar 21, 2022

Choose a reason for hiding this comment

k8s-ci-robot commented Mar 21, 2022

puerco commented Feb 15, 2022 •

edited

Loading