Container Image Policy

[philips]

Description

Organizations wish to avoid running "unapproved" images.

The exact nature of "approval" is beyond the scope of Kubernetes, but may include reasons like:

• only run images that are scanned to confirm they do no contain vulnerabilities
• only run images that use a "required" base image
• only run images that contain binaries which were built from peer reviewed, checked-in source by a trusted compiler toolchain.
• etc...

Progress Tracker

• Before Alpha
  • Write and maintain draft quality doc
    • DOC-LINK: https://docs.google.com/document/d/1u2czdRaPacwP2dtDxQr3Vg-fLjNi4UJCrxCIA_HEKLw/edit#
  • Design Approval
    • PROPOSAL-NUMBER Added image-policy proposal kubernetes#27129
    • Initial API review (if API). Maybe same PR as design doc. Adding types file for image admission controller. kubernetes#30241
    • My Shepherd is: Evan Cordell [email protected] @ecordell
    • My Secondary Contact Point is: Brandon Philips [email protected] @philips
  • Write (code + tests + docs) then get them merged. ImagePolicyWebhook Admission Controller kubernetes#30631
    • Code needs to be disabled by default. Verified by code OWNERS
    • Minimal testing
    • Minimal docs
      • cc @kubernetes/docs on docs PR
      • cc @kubernetes/feature-reviewers on this issue to get approval before checking this off
      • New apis: Glossary Section Item in the docs repo: kubernetes/kubernetes.github.io
    • Update release notes
• Before Beta
  • Testing is sufficient for beta
  • User docs with tutorials
    • Updated walkthrough / tutorial in the docs repo: kubernetes/kubernetes.github.io
    • cc @kubernetes/docs on docs PR
    • cc @kubernetes/feature-reviewers on this issue to get approval before checking this off
  • Thorough API review
    • cc @kubernetes/api
• Before Stable
  • docs/proposals/foo.md moved to docs/design/foo.md
    • cc @kubernetes/feature-reviewers on this issue to get approval before checking this off
  • Soak, load testing
  • detailed user docs and examples
    • cc @kubernetes/docs
    • cc @kubernetes/feature-reviewers on this issue to get approval before checking this off

FEATURE_STATUS: Proposal review

[idvoretskyi]

cc @kubernetes/sig-auth

[erictune]

@soltysh you were interested in this issue too.

[soltysh]

@erictune thx

[philips]

Status update: design proposal is merged: kubernetes/kubernetes#27129

[philips]

Also, @ecordell intends to work on the code for this feature now that the code has been merged. @Q-Lee @erictune @alex-mohr

[philips]

Updated the PRs for the current implementation kubernetes/kubernetes#30631 and API changes kubernetes/kubernetes#30241. Looks likely to land for v1.4. @Q-Lee and @ecordell how are y'all feeling?

[Q-Lee]

@philips It's looking good.

@philips The API is being tested in the merge queue atm, and the implementation is close to an lgtm. I'm setting up a test for gce/gci on top of ecordell's changes atm.

[ecordell]

@philips API is in! I'm hopeful the implementation will go through today

[ecordell]

kubernetes/kubernetes#30631 is merged

[janetkuo]

@philips Are the docs ready? Please update the docs in https://github.com/kubernetes/kubernetes.github.io, and then add PR numbers and check the docs box in the issue description

[jaredbhatti]

Ping. Any update on docs?

[Q-Lee]

@philips @ecordell What are the plans for the docs with this?

[ecordell]

@Q-Lee I'll work on them and have a PR soon

[ecordell]

Docs PR: kubernetes/website#1188

[ecordell]

For making image policy decisions, it's important that the backend be able to resolve tags to digests so that downstream services see a consistent view of approved images.

I've started sketching the changes here (no tests or codegen):

kubernetes/kubernetes@master...ecordell:imagereviewwebhook-digest

There is some overlap between this and kubernetes/community#132, but mutation is not in the scope of that proposal (simply planned for later).

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[erictune]

I recommend further features requests for image policy first be attempted using validating webhooks.

[saschagrunert]

Hey folks, what is the future plan for this feature? I see that it may fit into a native sigstore container image validation support for Kubernetes.