Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

9.4. Verifying container signatures for supply chain security

You can enhance supply chain security by using the sigstore signing methodology.

重要

sigstore support is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see the following link:

You can configure the container runtime to verify image integrity by using the sigstore signing methodology. Configuring MicroShift container runtimes enables the verification of image integrity. With the sigstore project, developers can digitally sign what they build, creating a safer chain of custody that traces software back to the source. Administrators can then verify signatures and monitor workflows at scale. By using sigstore, you can store signatures in the same registry as the build images.

  • For user-specific images, you must update the configuration file to point to the appropriate public key, or disable signature verification for those image sources.
重要

For disconnected or offline configurations, you must embed the public key contents into the operating system image.

9.4.2. Verifying container signatures using sigstore
复制链接

Verify container signatures for MicroShift by configuring the container runtime to use sigstore. The container signature verification uses the public key from the Red Hat keypair when signing the images. To use sigstore, edit the default /etc/containers/policy.json file that is installed as part of the container runtime package.

You can access Red Hat public keys at the following link:

You must use the release key 3 for verifying MicroShift container signatures.

Prerequisites

  • You have admin access to the MicroShift host.
  • You installed MicroShift.

Procedure

  1. Download the relevant public key and save it as /etc/containers/RedHat_ReleaseKey3.pub by running the following command: 

    $ sudo curl -sL https://access.redhat.com/security/data/63405576.txt -o /etc/containers/RedHat_ReleaseKey3.pub

  2. To configure the container runtime to verify images from Red Hat sources, edit the /etc/containers/policy.json file to contain the following configuration:

    Example policy JSON file

    {
    "default": [
        {
            "type": "reject"
        }
    ],
    "transports": {
        "docker": {
            "quay.io/openshift-release-dev": [{
                "type": "sigstoreSigned",
                "keyPath": "/etc/containers/RedHat_ReleaseKey3.pub",
                "signedIdentity": {
                    "type": "matchRepoDigestOrExact"
                }
            }],
            "registry.redhat.io": [{
                "type": "sigstoreSigned",
                "keyPath": "/etc/containers/RedHat_ReleaseKey3.pub",
                "signedIdentity": {
                    "type": "matchRepoDigestOrExact"
                }
            }]
        }
    }
}

  3. Configure Red Hat remote registries to use sigstore attachments when pulling images to the local storage, by editing the /etc/containers/registries.d/registry.redhat.io.yaml file to contain the following configuration: 

    $ cat /etc/containers/registries.d/registry.redhat.io.yaml
docker:
     registry.redhat.io:
         use-sigstore-attachments: true

  4. Configure Red Hat remote registries to use sigstore attachments when pulling images to the local storage, by editing the /etc/containers/registries.d/registry.quay.io.yaml file to contain the following configuration: 

    $ cat /etc/containers/registries.d/quay.io.yaml
docker:
  quay.io/openshift-release-dev:
    use-sigstore-attachments: true
  5. Create user-specific registry configuration files if your use case requires signature verification for those image sources. You can use the example here to start with and add your own requirements.

Next steps

  1. If you are using a mirror registry, enable sigstore attachments.
  2. Otherwise, proceed to wiping the local container storage clean.

If you are using mirror registries you must apply additional configuration to enable sigstore attachments and mirroring by digest.

Prerequisites

  • You have admin access to the MicroShift host.
  • You completed the steps in "Verifying container signatures using sigstore."

Procedure

  1. Enable sigstore attachments by creating the /etc/containers/registries.d/mirror.registry.local.yaml file. 

    $ cat /etc/containers/registries.d/<mirror.registry.local.yaml>
    1 
    
docker:
   mirror.registry.local:
        use-sigstore-attachments: true
    1
    Name the <mirror.registry.local.yaml> file after your mirror registry URL.

  2. Enable mirroring by digest by creating the /etc/containers/registries.conf.d/999-microshift-mirror.conf with the following contents: 

    $ cat /etc/containers/registries.conf.d/999-microshift-mirror.conf
[[registry]]
    prefix = "quay.io/openshift-release-dev"
    location = "mirror.registry.local"
    mirror-by-digest-only = true

[[registry]]
    prefix = "registry.redhat.io"
    location = "mirror.registry.local"
    mirror-by-digest-only = true

Next steps

  1. Wipe the local container storage clean.

9.4.2.2. Wiping local container storage clean
复制链接

When you apply the configuration to an existing system, you must wipe the local container storage clean. Cleaning the container storage ensures that container images with signatures are properly downloaded.

Prerequisites

  • You have administrator access to the MicroShift host.
  • You enabled sigstore on your mirror registries.

Procedure

  1. Stop the CRI-O container runtime service and MicroShift by running the following command: 

    $ sudo systemctl stop crio microshift

  2. Wipe the CRI-O container runtime storage clean by running the following command: 

    $ sudo crio wipe --force

  3. Restart the CRI-O container runtime service and MicroShift by running the following command: 

    $ sudo systemctl start crio microshift

Verification

Verify that all pods are running in a healthy state by entering the following command: 

$ oc get pods -A

Example output

NAMESPACE                   NAME                                                     READY   STATUS   RESTARTS  AGE
default                     i-06166fbb376f14a8bus-west-2computeinternal-debug-qtwcr  1/1     Running  0		    46m
kube-system                 csi-snapshot-controller-5c6586d546-lprv4                 1/1     Running  0		    51m
openshift-dns               dns-default-45jl7                                        2/2     Running  0		    50m
openshift-dns               node-resolver-7wmzf                                      1/1     Running  0		    51m
openshift-ingress           router-default-78b86fbf9d-qvj9s                          1/1     Running  0		    51m
openshift-ovn-kubernetes    ovnkube-master-5rfhh                                     4/4     Running  0		    51m
openshift-ovn-kubernetes    ovnkube-node-gcnt6                                       1/1     Running  0		    51m
openshift-service-ca        service-ca-bf5b7c9f8-pn6rk                               1/1     Running  0		    51m
openshift-storage           topolvm-controller-549f7fbdd5-7vrmv                      5/5     Running  0		    51m
openshift-storage           topolvm-node-rht2m                                       3/3     Running  0		    50m

注意

This example output shows a basic MicroShift installation. If you installed optional RPMs, the status of pods running those services is also expected in your output.

Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

Legal Notice

Theme

© 2026 Red Hat返回顶部