Skip to content

Commit 9b63f4a

Browse files
QiWang19QiWang19
committed
promote featuregate SigstoreImageVerificationPKI to techpreview
Signed-off-by: Qi Wang <[email protected]>
1 parent 768a119 commit 9b63f4a

File tree

24 files changed

+400
-28
lines changed

24 files changed

+400
-28
lines changed

‎config/v1alpha1/types_image_policy.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ type PolicyRootOfTrust struct {
7878
// policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
7979
// "PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
8080
// "FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification.
81-
// "PKI" is a DevPreview feature that indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
81+
// "PKI" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
8282
// +unionDiscriminator
8383
// +required
8484
PolicyType PolicyType `json:"policyType"`

‎config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clusterimagepolicies-CustomNoUpgrade.crd.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ spec:
192192
policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
193193
"PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
194194
"FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification.
195-
"PKI" is a DevPreview feature that indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
195+
"PKI" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
196196
enum:
197197
- PublicKey
198198
- FulcioCAWithRekor

‎config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clusterimagepolicies-DevPreviewNoUpgrade.crd.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ spec:
192192
policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
193193
"PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
194194
"FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification.
195-
"PKI" is a DevPreview feature that indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
195+
"PKI" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
196196
enum:
197197
- PublicKey
198198
- FulcioCAWithRekor

‎config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clusterimagepolicies-TechPreviewNoUpgrade.crd.yaml

Lines changed: 94 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,12 +102,101 @@ spec:
102102
- fulcioSubject
103103
- rekorKeyData
104104
type: object
105+
pki:
106+
description: pki defines the root of trust based on Bring
107+
Your Own Public Key Infrastructure (BYOPKI) Root CA(s) and
108+
corresponding intermediate certificates.
109+
properties:
110+
caIntermediatesData:
111+
description: |-
112+
caIntermediatesData contains base64-encoded data of a certificate bundle PEM file, which contains one or more intermediate certificates in the PEM format. The total length of the data must not exceed 8192 characters.
113+
caIntermediatesData requires caRootsData to be set.
114+
format: byte
115+
maxLength: 8192
116+
type: string
117+
x-kubernetes-validations:
118+
- message: the caIntermediatesData must start with base64
119+
encoding of '-----BEGIN CERTIFICATE-----'.
120+
rule: string(self).startsWith('-----BEGIN CERTIFICATE-----')
121+
- message: the caIntermediatesData must end with base64
122+
encoding of '-----END CERTIFICATE-----'.
123+
rule: string(self).endsWith('-----END CERTIFICATE-----\n')
124+
|| string(self).endsWith('-----END CERTIFICATE-----')
125+
- message: caIntermediatesData must be base64 encoding
126+
of valid PEM format data contain the same number of
127+
'-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----'
128+
markers.
129+
rule: string(self).findAll('-----BEGIN CERTIFICATE-----').size()
130+
== string(self).findAll('-----END CERTIFICATE-----').size()
131+
caRootsData:
132+
description: caRootsData contains base64-encoded data
133+
of a certificate bundle PEM file, which contains one
134+
or more CA roots in the PEM format. The total length
135+
of the data must not exceed 8192 characters.
136+
format: byte
137+
maxLength: 8192
138+
type: string
139+
x-kubernetes-validations:
140+
- message: the caRootsData must start with base64 encoding
141+
of '-----BEGIN CERTIFICATE-----'.
142+
rule: string(self).startsWith('-----BEGIN CERTIFICATE-----')
143+
- message: the caRootsData must end with base64 encoding
144+
of '-----END CERTIFICATE-----'.
145+
rule: string(self).endsWith('-----END CERTIFICATE-----\n')
146+
|| string(self).endsWith('-----END CERTIFICATE-----')
147+
- message: caRootsData must be base64 encoding of valid
148+
PEM format data contain the same number of '-----BEGIN
149+
CERTIFICATE-----' and '-----END CERTIFICATE-----'
150+
markers.
151+
rule: string(self).findAll('-----BEGIN CERTIFICATE-----').size()
152+
== string(self).findAll('-----END CERTIFICATE-----').size()
153+
pkiCertificateSubject:
154+
description: pkiCertificateSubject defines the requirements
155+
imposed on the subject to which the certificate was
156+
issued.
157+
properties:
158+
email:
159+
description: |-
160+
email specifies the expected email address imposed on the subject to which the certificate was issued, and must match the email address listed in the Subject Alternative Name (SAN) field of the certificate.
161+
The email should be a valid email address and at most 320 characters in length.
162+
maxLength: 320
163+
type: string
164+
x-kubernetes-validations:
165+
- message: invalid email address in pkiCertificateSubject
166+
rule: self.matches('^\\S+@\\S+$')
167+
hostname:
168+
description: |-
169+
hostname specifies the expected hostname imposed on the subject to which the certificate was issued, and it must match the hostname listed in the Subject Alternative Name (SAN) DNS field of the certificate.
170+
The hostname should be a valid dns 1123 subdomain name, optionally prefixed by '*.', and at most 253 characters in length.
171+
It should consist only of lowercase alphanumeric characters, hyphens, periods and the optional preceding asterisk.
172+
maxLength: 253
173+
type: string
174+
x-kubernetes-validations:
175+
- message: hostname should be a valid dns 1123 subdomain
176+
name, optionally prefixed by '*.'. It should consist
177+
only of lowercase alphanumeric characters, hyphens,
178+
periods and the optional preceding asterisk.
179+
rule: 'self.startsWith(''*.'') ? !format.dns1123Subdomain().validate(self.replace(''*.'',
180+
'''', 1)).hasValue() : !format.dns1123Subdomain().validate(self).hasValue()'
181+
type: object
182+
x-kubernetes-validations:
183+
- message: at least one of email or hostname must be set
184+
in pkiCertificateSubject
185+
rule: has(self.email) || has(self.hostname)
186+
required:
187+
- caRootsData
188+
- pkiCertificateSubject
189+
type: object
105190
policyType:
106191
description: |-
107192
policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
108193
"PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
109194
"FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification.
110-
"PKI" is a DevPreview feature that indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
195+
"PKI" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
196+
enum:
197+
- PublicKey
198+
- FulcioCAWithRekor
199+
- PKI
111200
type: string
112201
publicKey:
113202
description: publicKey defines the root of trust based on
@@ -134,6 +223,10 @@ spec:
134223
- policyType
135224
type: object
136225
x-kubernetes-validations:
226+
- message: pki is required when policyType is PKI, and forbidden
227+
otherwise
228+
rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
229+
has(self.pki) : !has(self.pki)'
137230
- message: publicKey is required when policyType is PublicKey,
138231
and forbidden otherwise
139232
rule: 'has(self.policyType) && self.policyType == ''PublicKey''

‎config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_imagepolicies-CustomNoUpgrade.crd.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ spec:
192192
policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
193193
"PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
194194
"FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification.
195-
"PKI" is a DevPreview feature that indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
195+
"PKI" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
196196
enum:
197197
- PublicKey
198198
- FulcioCAWithRekor

‎config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_imagepolicies-DevPreviewNoUpgrade.crd.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ spec:
192192
policyType serves as the union's discriminator. Users are required to assign a value to this field, choosing one of the policy types that define the root of trust.
193193
"PublicKey" indicates that the policy relies on a sigstore publicKey and may optionally use a Rekor verification.
194194
"FulcioCAWithRekor" indicates that the policy is based on the Fulcio certification and incorporates a Rekor verification.
195-
"PKI" is a DevPreview feature that indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
195+
"PKI" indicates that the policy is based on the certificates from Bring Your Own Public Key Infrastructure (BYOPKI). This value is enabled by turning on the SigstoreImageVerificationPKI feature gate.
196196
enum:
197197
- PublicKey
198198
- FulcioCAWithRekor

0 commit comments

Comments
 (0)