@@ -11,10 +11,6 @@ weight: 420
11
11
12
12
## {{% heading "prerequisites" %}}
13
13
14
- These instructions are for Kubernetes v{{< skew currentVersion >}}. If you want
15
- to check the integrity of components for a different version of Kubernetes,
16
- check the documentation for that Kubernetes release.
17
-
18
14
You will need to have the following tools installed:
19
15
20
16
- ` cosign ` ([ install guide] ( https://docs.sigstore.dev/cosign/installation/ ) )
45
41
Then verify the blob by using ` cosign verify-blob ` :
46
42
47
43
``` shell
48
- cosign verify-blob
" $BINARY " --signature
" $BINARY " .sig --certificate
" $BINARY " .cert --certificate-identity
[email protected] --certificate-oidc-issuer https://accounts.google.com
44
+ cosign verify-blob " $BINARY " \
45
+ --signature " $BINARY " .sig \
46
+ --certificate " $BINARY " .cert \
47
+ --certificate-identity
[email protected] \
48
+ --certificate-oidc-issuer https://accounts.google.com
49
49
```
50
50
51
51
{{< note >}}
52
52
Cosign 2.0 requires the ` --certificate-identity ` and ` --certificate-oidc-issuer ` options.
53
53
54
- To learn more about keyless signing, please refer to [ Keyless
55
- Signatures] ( https://docs.sigstore.dev/cosign/keyless ) .
54
+ To learn more about keyless signing, please refer to [ Keyless Signatures] ( https://docs.sigstore.dev/cosign/keyless ) .
56
55
57
56
Previous versions of Cosign required that you set ` COSIGN_EXPERIMENTAL=1 ` .
58
57
@@ -68,26 +67,38 @@ Pick one image from this list and verify its signature using
68
67
the ` cosign verify ` command:
69
68
70
69
``` shell
71
- cosign verify registry.k8s.io/kube-apiserver-amd64:v{{
< skew currentPatchVersion
> }} --certificate-identity
[email protected] --certificate-oidc-issuer https://accounts.google.com
| jq
.
70
+ cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion > }} \
71
+ --certificate-identity
[email protected] \
72
+ --certificate-oidc-issuer https://accounts.google.com \
73
+ | jq .
72
74
```
73
75
74
76
### Verifying images for all control plane components
75
77
76
- To verify all signed control plane images for the latest stable version (v{{< skew currentPatchVersion >}}), please run the following commands:
78
+ To verify all signed control plane images for the latest stable version
79
+ (v{{< skew currentPatchVersion >}}), please run the following commands:
77
80
78
81
``` shell
79
- curl -Ls " https://sbom.k8s.io/$( curl -Ls https://dl.k8s.io/release/stable.txt) /release" | grep " SPDXID: SPDXRef-Package-registry.k8s.io" | grep -v sha256 | cut -d- -f3- | sed ' s/-/\//' | sed ' s/-v1/:v1/' | sort > images.txt
82
+ curl -Ls " https://sbom.k8s.io/$( curl -Ls https://dl.k8s.io/release/stable.txt) /release" \
83
+ | grep " SPDXID: SPDXRef-Package-registry.k8s.io" \
84
+ | grep -v sha256 | cut -d- -f3- | sed ' s/-/\//' | sed ' s/-v1/:v1/' \
85
+ | sort > images.txt
80
86
input=images.txt
81
87
while IFS= read -r image
82
88
do
83
- cosign verify
" $image " --certificate-identity
[email protected] --certificate-oidc-issuer https://accounts.google.com
| jq
.
89
+ cosign verify " $image " \
90
+ --certificate-identity
[email protected] \
91
+ --certificate-oidc-issuer https://accounts.google.com \
92
+ | jq .
84
93
done < " $input "
85
94
```
86
95
87
96
Once you have verified an image, you can specify the image by its digest in your Pod
88
97
manifests as per this example:
89
98
90
- ` registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2 `
99
+ ``` console
100
+ registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
101
+ ```
91
102
92
103
For more information, please refer
93
104
to the [ Image Pull Policy] ( /docs/concepts/containers/images/#image-pull-policy )
0 commit comments