search string side menu

BRIX On-Premises > BRIX On-Premises Enterprise > Install add-on components for BRIX > Install Kyverno / Signature verification policy for Docker images

Signature verification policy for Docker images

The policy applies when it is necessary to ensure that the image is owned by a trusted publisher and has not been modified. Signing Docker images is a process to ensure their authenticity and consistency. This is accomplished by adding a digital signature to the Docker image that can be verified during deployment.

начало внимание

The policy is available from BRIX On-Premises version 2024.3.0 on.

конец внимание

The configuration file must be filled in for deployment.

Fill in the configuration file

Fill in the values-kyverno.yaml configuration file to install Kyverno.

  1. Configure the signature verification policy for Docker images. The policy is disabled by default. To enable the policy, set kyverno.checkImageSign.enabled to true.
  2. If you have multiple BRIX On-Premises application instances installed in your Kubernetes cluster, but you only want to apply signature verification for Docker images to a subset of BRIX application instances, fill in the kyverno.checkImageSign.namespace parameter. This parameter specifies the namespace of the BRIX application instances.
  3. Specify the namespace for the Kyverno service: in this case, it is kyverno. To ensure high availability, specify the required number of replicas in the kyverno.replicaCount parameter.

## Configure kyverno
kyverno:
...
  ## signature verification policy for Docker images
  checkImageSign:
    enabled: false
    ## list of registries for which the signature policy for Docker images will be applied
    registry:
      - hub.elma365.tech
    ## list of namespaces in which the signature policy for Docker images will be applied
    # namespace:
      # - elma365-dev
      # - elma365-prod
    ## secret for accessing Docker images to apply the signature policy for Docker images
    existingImagePullSecrets:
      - yandexsecret
  namespace: kyverno
  ## number of replicas to ensure high availability
  replicaCount: 1
  ## crds installation (not required, added to the crds directory)
  installCRDs: false
...

Filling in parameters for connecting to a private registry to install Kyverno in a closed-loop environment without internet access

To connect to a private registry:

  1. Download BRIX images and upload them to the local image registry. Read more about this in the Download BRIX images article.
  2. Set the address and path for the kyverno.image.repository, kyverno.initImage.repository, and kyverno.cleanupController.image.repository parameters.
  3. Specify the name of the secret with access rights to the private registry in kyverno.image.pullSecrets and kyverno.cleanupController.image.pullSecrets. The secret must be created manually and encrypted in Base64.

## Configure kyverno
kyverno:
...
  ## parameters for connecting to a private registry
  image:
## address and path for the private registry
    repository: registry.example.com/kyverno/kyverno
    tag: v1.9.0
## secret with access rights to the private registry must be created manually, encrypted in Base64
    pullSecrets:
      - myRegistryKeySecretName
  initImage:
## address and path for the private registry
    repository: registry.example.com/kyverno/kyvernopre
    tag: v1.9.0
  cleanupController:
    image:
## address and path for the private registry
      repository: registry.example.com/kyverno/cleanup-controller
      tag: v1.9.0
## secret with access rights to the private registry must be created manually, encrypted in Base64
      pullSecrets:
        - myRegistryKeySecretName

where kyverno.image.repository format is as follows:

  • The address is registry.example.com.
  • The path is /kyverno/kyverno; kyverno.initImage.repositor.
  • The address is registry.example.com.
  • The path is /kyverno/kyvernopre; kyverno.cleanupController.repository.
  • The address is registry.example.com.
  • The path is /kyverno/cleanup-controller.

 

ca-certificates-adding-policy.html install-linkerd.html