Skip to content

Commit 1ee1ef8

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #2088 from QiWang19/byopki-api
OCPNODE-2339: Add PKI field to (cluster)imagepolicy
2 parents ca270f6 + 347c75c commit 1ee1ef8

File tree

32 files changed

+2125
-23
lines changed

32 files changed

+2125
-23
lines changed

‎config/v1alpha1/tests/clusterimagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml

Lines changed: 117 additions & 0 deletions
Large diffs are not rendered by default.

‎config/v1alpha1/tests/imagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml

Lines changed: 117 additions & 0 deletions
Large diffs are not rendered by default.

‎config/v1alpha1/types_image_policy.go

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,12 @@ type Policy struct {
7373
// +union
7474
// +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'PublicKey' ? has(self.publicKey) : !has(self.publicKey)",message="publicKey is required when policyType is PublicKey, and forbidden otherwise"
7575
// +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'FulcioCAWithRekor' ? has(self.fulcioCAWithRekor) : !has(self.fulcioCAWithRekor)",message="fulcioCAWithRekor is required when policyType is FulcioCAWithRekor, and forbidden otherwise"
76+
// +openshift:validation:FeatureGateAwareXValidation:featureGate=SigstoreImageVerificationPKI,rule="has(self.policyType) && self.policyType == 'PKI' ? has(self.pki) : !has(self.pki)",message="pki is required when policyType is PKI, and forbidden otherwise"
7677
type PolicyRootOfTrust struct {
7778
// policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
7879
// "PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
7980
// "FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification.
81+
// "PKI" is a DevPreview feature that indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
8082
// +unionDiscriminator
8183
// +required
8284
PolicyType PolicyType `json:"policyType"`
@@ -88,14 +90,20 @@ type PolicyRootOfTrust struct {
8890
// https://github.com/sigstore/fulcio and https://github.com/sigstore/rekor
8991
// +optional
9092
FulcioCAWithRekor *FulcioCAWithRekor `json:"fulcioCAWithRekor,omitempty"`
93+
// pki defines the root of trust based on Bring Your Own Public Key Infrastructure (BYOPKI) Root CA(s) and corresponding intermediate certificates.
94+
// +optional
95+
// +openshift:enable:FeatureGate=SigstoreImageVerificationPKI
96+
PKI *PKI `json:"pki,omitempty"`
9197
}
9298

93-
// +kubebuilder:validation:Enum=PublicKey;FulcioCAWithRekor
99+
// +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=PublicKey;FulcioCAWithRekor
100+
// +openshift:validation:FeatureGateAwareEnum:featureGate=SigstoreImageVerificationPKI,enum=PublicKey;FulcioCAWithRekor;PKI
94101
type PolicyType string
95102

96103
const (
97104
PublicKeyRootOfTrust PolicyType = "PublicKey"
98105
FulcioCAWithRekorRootOfTrust PolicyType = "FulcioCAWithRekor"
106+
PKIRootOfTrust PolicyType = "PKI"
99107
)
100108

101109
// PublicKey defines the root of trust based on a sigstore public key.
@@ -143,6 +151,48 @@ type PolicyFulcioSubject struct {
143151
SignedEmail string `json:"signedEmail"`
144152
}
145153

154+
// PKI defines the root of trust based on Root CA(s) and corresponding intermediate certificates.
155+
type PKI struct {
156+
// caRootsData contains base64-encoded data of a certificate bundle PEM file, which contains one or more CA roots in the PEM format. The total length of the data must not exceed 8192 characters.
157+
// +required
158+
// +kubebuilder:validation:MaxLength=8192
159+
// +kubebuilder:validation:XValidation:rule="string(self).startsWith('-----BEGIN CERTIFICATE-----')",message="the caRootsData must start with base64 encoding of '-----BEGIN CERTIFICATE-----'."
160+
// +kubebuilder:validation:XValidation:rule="string(self).endsWith('-----END CERTIFICATE-----\\n') || string(self).endsWith('-----END CERTIFICATE-----')",message="the caRootsData must end with base64 encoding of '-----END CERTIFICATE-----'."
161+
// +kubebuilder:validation:XValidation:rule="string(self).findAll('-----BEGIN CERTIFICATE-----').size() == string(self).findAll('-----END CERTIFICATE-----').size()",message="caRootsData must be base64 encoding of valid PEM format data contain the same number of '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' markers."
162+
CertificateAuthorityRootsData []byte `json:"caRootsData"`
163+
// caIntermediatesData contains base64-encoded data of a certificate bundle PEM file, which contains one or more intermediate certificates in the PEM format. The total length of the data must not exceed 8192 characters.
164+
// caIntermediatesData requires caRootsData to be set.
165+
// +optional
166+
// +kubebuilder:validation:XValidation:rule="string(self).startsWith('-----BEGIN CERTIFICATE-----')",message="the caIntermediatesData must start with base64 encoding of '-----BEGIN CERTIFICATE-----'."
167+
// +kubebuilder:validation:XValidation:rule="string(self).endsWith('-----END CERTIFICATE-----\\n') || string(self).endsWith('-----END CERTIFICATE-----')",message="the caIntermediatesData must end with base64 encoding of '-----END CERTIFICATE-----'."
168+
// +kubebuilder:validation:XValidation:rule="string(self).findAll('-----BEGIN CERTIFICATE-----').size() == string(self).findAll('-----END CERTIFICATE-----').size()",message="caIntermediatesData must be base64 encoding of valid PEM format data contain the same number of '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' markers."
169+
// +kubebuilder:validation:MaxLength=8192
170+
CertificateAuthorityIntermediatesData []byte `json:"caIntermediatesData,omitempty"`
171+
172+
// pkiCertificateSubject defines the requirements imposed on the subject to which the certificate was issued.
173+
// +required
174+
PKICertificateSubject PKICertificateSubject `json:"pkiCertificateSubject"`
175+
}
176+
177+
// PKICertificateSubject defines the requirements imposed on the subject to which the certificate was issued.
178+
// +kubebuilder:validation:XValidation:rule="has(self.email) || has(self.hostname)", message="at least one of email or hostname must be set in pkiCertificateSubject"
179+
// +openshift:enable:FeatureGate=SigstoreImageVerificationPKI
180+
type PKICertificateSubject struct {
181+
// email specifies the expected email address imposed on the subject to which the certificate was issued, and must match the email address listed in the Subject Alternative Name (SAN) field of the certificate.
182+
// The email should be a valid email address and at most 320 characters in length.
183+
// +optional
184+
// +kubebuilder:validation:MaxLength:=320
185+
// +kubebuilder:validation:XValidation:rule=`self.matches('^\\S+@\\S+$')`,message="invalid email address in pkiCertificateSubject"
186+
Email string `json:"email,omitempty"`
187+
// hostname specifies the expected hostname imposed on the subject to which the certificate was issued, and it must match the hostname listed in the Subject Alternative Name (SAN) DNS field of the certificate.
188+
// The hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.', and at most 253 characters in length.
189+
// It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk.
190+
// +optional
191+
// +kubebuilder:validation:MaxLength:=253
192+
// +kubebuilder:validation:XValidation:rule="self.startsWith('*.') ? !format.dns1123Subdomain().validate(self.replace('*.', '', 1)).hasValue() : !format.dns1123Subdomain().validate(self).hasValue()",message="hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.'. It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk."
193+
Hostname string `json:"hostname,omitempty"`
194+
}
195+
146196
// PolicyIdentity defines image identity the signature claims about the image. When omitted, the default matchPolicy is "MatchRepoDigestOrExact".
147197
// +kubebuilder:validation:XValidation:rule="(has(self.matchPolicy) && self.matchPolicy == 'ExactRepository') ? has(self.exactRepository) : !has(self.exactRepository)",message="exactRepository is required when matchPolicy is ExactRepository, and forbidden otherwise"
148198
// +kubebuilder:validation:XValidation:rule="(has(self.matchPolicy) && self.matchPolicy == 'RemapIdentity') ? has(self.remapIdentity) : !has(self.remapIdentity)",message="remapIdentity is required when matchPolicy is RemapIdentity, and forbidden otherwise"

‎config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clusterimagepolicies-CustomNoUpgrade.crd.yaml

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,14 +102,101 @@ spec:
102102
- fulcioSubject
103103
- rekorKeyData
104104
type: object
105+
pki:
106+
description: pki defines the root of trust based on Bring
107+
Your Own Public Key Infrastructure (BYOPKI) Root CA(s) and
108+
corresponding intermediate certificates.
109+
properties:
110+
caIntermediatesData:
111+
description: |-
112+
caIntermediatesData contains base64-encoded data of a certificate bundle PEM file, which contains one or more intermediate certificates in the PEM format. The total length of the data must not exceed 8192 characters.
113+
caIntermediatesData requires caRootsData to be set.
114+
format: byte
115+
maxLength: 8192
116+
type: string
117+
x-kubernetes-validations:
118+
- message: the caIntermediatesData must start with base64
119+
encoding of '-----BEGIN CERTIFICATE-----'.
120+
rule: string(self).startsWith('-----BEGIN CERTIFICATE-----')
121+
- message: the caIntermediatesData must end with base64
122+
encoding of '-----END CERTIFICATE-----'.
123+
rule: string(self).endsWith('-----END CERTIFICATE-----\n')
124+
|| string(self).endsWith('-----END CERTIFICATE-----')
125+
- message: caIntermediatesData must be base64 encoding
126+
of valid PEM format data contain the same number of
127+
'-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----'
128+
markers.
129+
rule: string(self).findAll('-----BEGIN CERTIFICATE-----').size()
130+
== string(self).findAll('-----END CERTIFICATE-----').size()
131+
caRootsData:
132+
description: caRootsData contains base64-encoded data
133+
of a certificate bundle PEM file, which contains one
134+
or more CA roots in the PEM format. The total length
135+
of the data must not exceed 8192 characters.
136+
format: byte
137+
maxLength: 8192
138+
type: string
139+
x-kubernetes-validations:
140+
- message: the caRootsData must start with base64 encoding
141+
of '-----BEGIN CERTIFICATE-----'.
142+
rule: string(self).startsWith('-----BEGIN CERTIFICATE-----')
143+
- message: the caRootsData must end with base64 encoding
144+
of '-----END CERTIFICATE-----'.
145+
rule: string(self).endsWith('-----END CERTIFICATE-----\n')
146+
|| string(self).endsWith('-----END CERTIFICATE-----')
147+
- message: caRootsData must be base64 encoding of valid
148+
PEM format data contain the same number of '-----BEGIN
149+
CERTIFICATE-----' and '-----END CERTIFICATE-----'
150+
markers.
151+
rule: string(self).findAll('-----BEGIN CERTIFICATE-----').size()
152+
== string(self).findAll('-----END CERTIFICATE-----').size()
153+
pkiCertificateSubject:
154+
description: pkiCertificateSubject defines the requirements
155+
imposed on the subject to which the certificate was
156+
issued.
157+
properties:
158+
email:
159+
description: |-
160+
email specifies the expected email address imposed on the subject to which the certificate was issued, and must match the email address listed in the Subject Alternative Name (SAN) field of the certificate.
161+
The email should be a valid email address and at most 320 characters in length.
162+
maxLength: 320
163+
type: string
164+
x-kubernetes-validations:
165+
- message: invalid email address in pkiCertificateSubject
166+
rule: self.matches('^\\S+@\\S+$')
167+
hostname:
168+
description: |-
169+
hostname specifies the expected hostname imposed on the subject to which the certificate was issued, and it must match the hostname listed in the Subject Alternative Name (SAN) DNS field of the certificate.
170+
The hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.', and at most 253 characters in length.
171+
It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk.
172+
maxLength: 253
173+
type: string
174+
x-kubernetes-validations:
175+
- message: hostname should be a valid dns 1123 subdomain
176+
name, optionally prefixed by '*.'. It should consist
177+
only of lowercase alphanumeric characters, hyphens,
178+
periods and the optional preceding asterisk.
179+
rule: 'self.startsWith(''*.'') ? !format.dns1123Subdomain().validate(self.replace(''*.'',
180+
'''', 1)).hasValue() : !format.dns1123Subdomain().validate(self).hasValue()'
181+
type: object
182+
x-kubernetes-validations:
183+
- message: at least one of email or hostname must be set
184+
in pkiCertificateSubject
185+
rule: has(self.email) || has(self.hostname)
186+
required:
187+
- caRootsData
188+
- pkiCertificateSubject
189+
type: object
105190
policyType:
106191
description: |-
107192
policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
108193
"PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
109194
"FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification.
195+
"PKI" is a DevPreview feature that indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
110196
enum:
111197
- PublicKey
112198
- FulcioCAWithRekor
199+
- PKI
113200
type: string
114201
publicKey:
115202
description: publicKey defines the root of trust based on
@@ -136,6 +223,10 @@ spec:
136223
- policyType
137224
type: object
138225
x-kubernetes-validations:
226+
- message: pki is required when policyType is PKI, and forbidden
227+
otherwise
228+
rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
229+
has(self.pki) : !has(self.pki)'
139230
- message: publicKey is required when policyType is PublicKey,
140231
and forbidden otherwise
141232
rule: 'has(self.policyType) && self.policyType == ''PublicKey''

0 commit comments

Comments
 (0)