webhook error: x509: certificate signed by unknown authority

[qicheng676]

Question

kubectl apply -f ../kind/deployment-alpine-cosign.yaml

Error from server (BadRequest): error when creating "../kind/deployment-alpine-cosign.yaml": admission w ebhook "policy.sigstore.dev" denied the request: validation failed: failed policy: image-policy-verify-1 : spec.template.spec.containers[0].image
harborhub.com:442/repo/alpine@sha256:c0d488a800e4127c334ad20d61d7bc21b4097540327217dfab52262adc02380c si gnature key validation failed for authority authority-0 for harborhub.com:442/repo/alpine@sha256:c0d488a 800e4127c334ad20d61d7bc21b4097540327217dfab52262adc02380c: Get "https://harborhub.com:442/v2/": x509: certificate signed by unknown authority

I refer to https://stackoverflow.com/questions/65724285/kubernetes-with-containerd-http-server-gave-http-response-to-https-client modify /etc/containerd/config.toml in kind-control-plane container and restart containerd，not work。

[plugins."io.containerd.grpc.v1.cri".registry]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."k8s.gcr.io"]
endpoint = ["https://registry.k8s.io", "https://k8s.gcr.io",]

[plugins."io.containerd.grpc.v1.cri".registry.mirrors."harborhub.com:442"]
endpoint = ["https://harborhub.com:442"]
[plugins."io.containerd.grpc.v1.cri".registry.configs]
[plugins."io.containerd.grpc.v1.cri".registry.configs."harborhub.com:442".tls]
insecure_skip_verify = true

env:
host: centos 7.6.1810 x86_64
kind: kind v0.17.0 go1.19.2 linux/amd64
k8s in kind: v1.25.3
host docker: Docker Engine - Community 20.10.20
policy-controller: 0.5.2
private registry domain used by /etc/hosts : IP harborhub.com ,and modify controller-policy yaml add hostAlias

Ask for Help

[hectorj2f]

@qicheng676 Firstly I assume a cosign verify works against your image. On the other hand, I suggest you try these changes to add a sefl-signed CA sigstore/helm-charts#453.

[qicheng676]

@qicheng676 Firstly I assume a cosign verify works against your image. On the other hand, I suggest you try these changes to add a sefl-signed CA sigstore/helm-charts#453.

yes， cosign verify --allow-insecure-registry works.
my now policy-controller is 0.3.9，I will upgrade to 0.4.0 and try

[qicheng676]

Thanks, it works for me