7.6. Image signature verification

You can use image signature verification to validate images that are uploaded to the Image service (glance) before storing the images in the configured back end. If validation fails for an image, then the upload is stopped and the image is deleted.

To protect image integrity and authenticity, you can save the signatures and public key certificates as image properties.

You store the secret for signature verification in the Key Manager service (barbican), and the Image service interacts with the Key Manager service through the internal endpoint provided by the Identity service (keystone):

[key_manager]
backend = barbican

[barbican]
auth_endpoint={{ .KeystoneInternalURL }}
barbican_endpoint_type=internal

Other services, such as the Compute service (nova) can use the image properties to perform data validation when a user downloads the image from the Image service.