Connaisseur

https://github.com/sse-secure-systems/connaisseur
Admin
A Kubernetes admission controller that integrates container image signature verification and trust...
Tokens:43,149
Snippets:475
Trust Score:8.4
License:Apache-2.0
Update:2 months ago
Show doc for...
Tokens:
Raw
### Connaisseur Output Example

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Example output of 'kubectl get all -n connaisseur' showing running pods, service, deployment, and replicaset.

```bash
NAME                                          READY   STATUS    RESTARTS   AGE
pod/connaisseur-deployment-78d8975596-42tkw   1/1     Running   0          22s
pod/connaisseur-deployment-78d8975596-5c4c6   1/1     Running   0          22s
pod/connaisseur-deployment-78d8975596-kvrj6   1/1     Running   0          22s

NAME                      TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
service/connaisseur-svc   ClusterIP   10.108.220.34   <none>        443/TCP   22s

NAME                                     READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/connaisseur-deployment   3/3     3            3           22s

NAME                                                DESIRED   CURRENT   READY   AGE
replicaset.apps/connaisseur-deployment-78d8975596   3         3         3       22s
```

--------------------------------

### Makefile Install Command

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Command to install Connaisseur using the Makefile.

```bash
make install
```

--------------------------------

### Install Connaisseur Helm Chart

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/charts/connaisseur/README.md

Install the Connaisseur chart into a dedicated namespace.

```console
helm install connaisseur connaisseur/connaisseur --rollback-on-failure --create-namespace --namespace connaisseur
```

--------------------------------

### Example Validator and Policy Configuration

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

A minimal example demonstrating validator and policy configuration, including rules for matching images and specifying validators and trust roots.

```yaml
application:
  validators:
  - name: default     # validator 1
    trustRoots:
    - name: default   # key 1
      key: |
        ...
  - name: myvalidator # validator 2
    trustRoots:
    - name: default   # key 2
      key: |
        ...
    - name: mykey     # key 3
      key: |
        ...

  policy:
  - pattern: "*:*"                      # rule 1
  - pattern: "docker.io/myrepo/*:*"     # rule 2
    validator: myvalidator
  - pattern: "docker.io/myrepo/myimg:*" # rule 3
    validator: myvalidator
    with:
      trustRoot: mykey
```

--------------------------------

### Setup the preliminary hook

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Applies the preliminary hook resources for Connaisseur deployment.

```bash
kubectl apply -f deploy.yaml -l "app.kubernetes.io/component=connaisseur-init" -n connaisseur
```

--------------------------------

### Output of getting the public root key

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notaryv1.md

This is an example of the output when using the get_root_key utility, showing the KeyID and the public key in PEM format.

```bash
KeyID: 76d211ff8d2317d78ee597dbc43888599d691dbfd073b8226512f0e9848f2508
Key: -----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsx28WV7BsQfnHF1kZmpdCTTLJaWe
d0CA+JOi8H4REuBaWSZ5zPDe468WuOJ6f71E7WFg3CVEVYHuoZt2UYbN/Q==
-----END PUBLIC KEY-----
```

--------------------------------

### Install Connaisseur via Helm

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/README.md

Deploy Connaisseur into a dedicated namespace using Helm.

```bash
helm install connaisseur helm --rollback-on-failure --create-namespace --namespace connaisseur
```

--------------------------------

### Example of a complete conventional commit

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/CONTRIBUTING.md

A concrete example of a commit message following the semantic and conventional commit standards.

```bash
git commit -m "fix: extend registry validation regex to custom ports" -m "The current regex used for validation of the image name does not allow using non-default ports for the image repository name. The regex is extended to optionally provide a port number." -m "Fix #3"
```

--------------------------------

### Install Connaisseur with custom values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Installs Connaisseur with a custom 'values.yaml' file for configuration.

```bash
helm install connaisseur connaisseur/connaisseur --rollback-on-failure --create-namespace --namespace connaisseur -f values.yaml
```

--------------------------------

### Example Cosign public key format

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/getting_started.md

The expected format of the generated public key file for Cosign.

```text
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvtc/qpHtx7iUUj+rRHR99a8mnGni
qiGkmUb9YpWWTS4YwlvwdmMDiGzcsHiDOYz6f88u2hCRF5GUCvyiZAKrsA==
-----END PUBLIC KEY-----
```

--------------------------------

### Prometheus Metrics Example

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/features/metrics.md

Example output of the \/metrics endpoint, showing Connaisseur-specific metrics and Go runtime metrics.

```text
# HELP connaisseur_requests_admitted_total The total number of admission requests that were admitted
# TYPE connaisseur_requests_admitted_total counter
connaisseur_requests_admitted_total 3
# HELP connaisseur_requests_denied_total The total number of admission requests that were denied
# TYPE connaisseur_requests_denied_total counter
connaisseur_requests_denied_total{timeout="false"} 4
# HELP connaisseur_requests_total The total number of admission requests posed to Connaisseur
# TYPE connaisseur_requests_total counter
connaisseur_requests_total 7
# HELP connaisseur_validations_failed_total The total number of image validations that failed
# TYPE connaisseur_validations_failed_total counter
connaisseur_validations_failed_total{type="notaryv1",validator_name="dockerhub"} 2
connaisseur_validations_failed_total{type="static",validator_name="deny"} 2
# HELP connaisseur_validations_skipped_total The total number of image validations that were skipped
# TYPE connaisseur_validations_skipped_total counter
connaisseur_validations_skipped_total{reason="automatic approval of child image reference",type="notaryv1",validator_name="dockerhub"} 2
# HELP connaisseur_validations_successful_total The total number of image validations that were successful
# TYPE connaisseur_validations_successful_total counter
connaisseur_validations_successful_total{type="notaryv1",validator_name="dockerhub"} 3
# HELP connaisseur_validations_total The total number of image validations performed by Connaisseur
# TYPE connaisseur_validations_total counter
connaisseur_validations_total{result="error",type="notaryv1",validator_name="dockerhub"} 2
connaisseur_validations_total{result="error",type="static",validator_name="deny"} 2
connaisseur_validations_total{result="success",type="notaryv1",validator_name="dockerhub"} 3
# HELP go_gc_duration_seconds A summary of the wall-time pause (stop-the-world) duration in garbage collection cycles.
# TYPE go_gc_duration_seconds summary
go_gc_duration_seconds{quantile="0"} 0.000120088
go_gc_duration_seconds{quantile="0.25"} 0.000364499
go_gc_duration_seconds{quantile="0.5"} 0.000666734
go_gc_duration_seconds{quantile="0.75"} 0.001108909
go_gc_duration_seconds{quantile="1"} 0.001615903
go_gc_duration_seconds_sum 0.007242773
go_gc_duration_seconds_count 9
# HELP go_gc_gogc_percent Heap size target percentage configured by the user, otherwise 100. This value is set by the GOGC environment variable, and the runtime/debug.SetGCPercent function. Sourced from \/gc\/gogc:percent.
# TYPE go_gc_gogc_percent gauge
go_gc_gogc_percent 100
# HELP go_gc_gomemlimit_bytes Go runtime memory limit configured by the user, otherwise math.MaxInt64. This value is set by the GOMEMLIMIT environment variable, and the runtime/debug.SetMemoryLimit function. Sourced from \/gc\/gomemlimit:bytes.
# TYPE go_gc_gomemlimit_bytes gauge
go_gc_gomemlimit_bytes 9.223372036854776e+18
# HELP go_goroutines Number of goroutines that currently exist.
# TYPE go_goroutines gauge
go_goroutines 18
# HELP go_info Information about the Go environment.
# TYPE go_info gauge
go_info{version="go1.25.8"} 1
# HELP go_memstats_alloc_bytes Number of bytes allocated in heap and currently in use. Equals to \/memory\/classes\/heap\/objects:bytes.
# TYPE go_memstats_alloc_bytes gauge
go_memstats_alloc_bytes 7.347368e+06
# HELP go_memstats_alloc_bytes_total Total number of bytes allocated in heap until now, even if released already. Equals to \/gc\/heap\/allocs:bytes.
# TYPE go_memstats_alloc_bytes_total counter
go_memstats_alloc_bytes_total 2.361952e+07
# HELP go_memstats_buck_hash_sys_bytes Number of bytes used by the profiling bucket hash table. Equals to \/memory\/classes\/profiling\/buckets:bytes.
# TYPE go_memstats_buck_hash_sys_bytes gauge
go_memstats_buck_hash_sys_bytes 1.461774e+06
# HELP go_memstats_frees_total Total number of heap objects frees. Equals to \/gc\/heap\/frees:objects + \/gc\/heap\/tiny\/allocs:objects.
# TYPE go_memstats_frees_total counter
go_memstats_frees_total 164143
# HELP go_memstats_gc_sys_bytes Number of bytes used for garbage collection system metadata. Equals to \/memory\/classes\/metadata\/other:bytes.
# TYPE go_memstats_gc_sys_bytes gauge
go_memstats_gc_sys_bytes 3.930896e+06
# HELP go_memstats_heap_alloc_bytes Number of heap bytes allocated and currently in use, same as go_memstats_alloc_bytes. Equals to \/memory\/classes\/heap\/objects:bytes.
# TYPE go_memstats_heap_alloc_bytes gauge
go_memstats_heap_alloc_bytes 7.347368e+06
# HELP go_memstats_heap_idle_bytes Number of heap bytes waiting to be used. Equals to \/memory\/classes\/heap\/released:bytes + \/memory\/classes\/heap\/free:bytes.

```

--------------------------------

### Example DCT public key format

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/getting_started.md

The expected format of the generated public key file for DCT.

```text
-----BEGIN PUBLIC KEY-----
role: root

MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELDzXwqie/P66R3gVpFDWMhxOyol5
YWD/KWnAaEIcJVTYUR+21NJSZz0yL7KLGrv50H9kHai5WWVsVykOZNoZYQ==
-----END PUBLIC KEY-----
```

--------------------------------

### Example Cache Configuration

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/features/caching.md

This example shows how to configure the cache settings in `charts/connaisseur/values.yaml`, setting the expiry to 15 seconds and disabling caching of errors.

```yaml
application:
  features:
    cache:
      expirySeconds: 15
      cacheErrors: false
```

--------------------------------

### Create a self-signed certificate

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notation.md

Example of creating a self-signed certificate using the Notation CLI for testing purposes.

```bash
# Create a self-signed certificate
notation cert generate-test --default "mykey"
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Example of adding authentication to a validator configuration using a Kubernetes secret.

```yaml
auth:
  secretName: k8ssecret
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Example configuration for Connaisseur policies, demonstrating different patterns, validators, and additional parameters.

```yaml
application:
  policy:
  - pattern: "*:*"
  - pattern: "docker.io/myrepo/*:*"
    validator: myvalidator
    with:
      trustRoot: mykey
  - pattern: "docker.io/myrepo/deniedimage:*"
    validator: deny
  - pattern: "docker.io/myrepo/allowedimage:v*"
    validator: allow
    with:
      mode: insecureValidateOnly
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Example configuration for notaryv1 and cosign validators in Connaisseur.

```yaml
application:
  validators:
  - name: default
    type: notaryv1
    host: notary.docker.io
    trustRoots:
    - name: default
      key: |
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsx28WV7BsQfnHF1kZmpdCTTLJaWe
        d0CA+JOi8H4REuBaWSZ5zPDe468WuOJ6f71E7WFg3CVEVYHuoZt2UYbN/Q==
        -----END PUBLIC KEY-----
    auth:
      username: superuser
      password: lookatmeimjumping
  - name: myvalidator
    type: cosign
    trustRoots:
    - name: mykey
      key: |
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIFXO1w6oj0oI2Fk9SiaNJRKTiO9d
        ksm6hFczQAq+FDdw0istEdCwcHO61O/0bV+LC8jqFoomA28cT+py6FcSYw==
        -----END PUBLIC KEY-----
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Example configuration for static validators (allowlist and denylist) in Connaisseur.

```yaml
application:
  validators:
  - name: allow
    type: static
    approve: true
  - name: deny
    type: static
    approve: false
```

--------------------------------

### Example of detection mode in action

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/features/detection_mode.md

Demonstrates how kubectl behaves when an unsigned image is run in detection mode, showing a warning message.

```bash
kubectl run unsigned --image=docker.io/securesystemsengineering/testimage:unsigned
> Warning: Unable to find signed digest for image docker.io/securesystemsengineering/testimage:unsigned. (not denied due to DETECTION_MODE)
> pod/unsigned created
```

--------------------------------

### Validator Configuration Example

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/adr/ADR-4_modular.md

Example of how the 'validators' section in values.yaml might be structured, defining different validation methods.

```yaml
validators:
- name: "dockerhub-nv2"
  type: "notaryv2"
  ...
- name: "harbor-nv1"
  type: "notaryv1"
  host: "notary.harbor.io"
  root_keys:
    - name: "default"
      key: "..."
- name: "cosign"
  type: "cosign"
  ...
```

--------------------------------

### Prometheus Metrics Example

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/features/metrics.md

An example of metrics exposed by Connaisseur in Prometheus exposition format.

```text
# TYPE process_start_time_seconds gauge
process_start_time_seconds 1.77280778538e+09
# HELP process_virtual_memory_bytes Virtual memory size in bytes.
# TYPE process_virtual_memory_bytes gauge
process_virtual_memory_bytes 1.341710336e+09
# HELP process_virtual_memory_max_bytes Maximum amount of virtual memory available in bytes.
# TYPE process_virtual_memory_max_bytes gauge
process_virtual_memory_max_bytes 1.8446744073709552e+19
# HELP promhttp_metric_handler_requests_in_flight Current number of scrapes being served.
# TYPE promhttp_metric_handler_requests_in_flight gauge
promhttp_metric_handler_requests_in_flight 1
# HELP promhttp_metric_handler_requests_total Total number of scrapes by HTTP status code.
# TYPE promhttp_metric_handler_requests_total counter
promhttp_metric_handler_requests_total{code="200"} 1
promhttp_metric_handler_requests_total{code="500"} 0
promhttp_metric_handler_requests_total{code="503"} 0
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Example configuration for validating only own images and denying all others, including validator definitions and policy rules.

```yaml
application:
  validators:
  - name: allow
    type: static
    approve: true
  - name: default
    type: notaryv1  # or e.g. 'cosign'
    host: notary.docker.io  # only required in case of notaryv1
    trustRoots:
    - name: default
      key: |  # your public key below
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvtc/qpHtx7iUUj+rRHR99a8mnGni
        qiGkmUb9YpWWTS4YwlvwdmMDiGzcsHiDOYz6f88u2hCRF5GUCvyiZAKrsA==
        -----END PUBLIC KEY-----
  - name: dockerhub_basics
    type: notaryv1
    host: notary.docker.io
    trustRoots:
    - name: securesystemsengineering_official
      key: |
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsx28WV7BsQfnHF1kZmpdCTTLJaWe
        d0CA+JOi8H4REuBaWSZ5zPDe468WuOJ6f71E7WFg3CVEVYHuoZt2UYbN/Q==
        -----END PUBLIC KEY-----

  policy:
  - pattern: "*:*"
  - pattern: "registry.k8s.io/*:*"
    validator: allow
  - pattern: "docker.io/securesystemsengineering/*:"
    validator: dockerhub_basics
    with:
      trustRoot: securesystemsengineering_official
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Configuration example for cosign validator with host-specific trust material for private Sigstore infrastructures.

```yaml
name: default
type: cosign
host:
  rekorPubkey: |
    -----BEGIN PUBLIC KEY-----
    ...
    -----END PUBLIC KEY-----
  ctLogPubkey: |
    -----BEGIN PUBLIC KEY-----
    ...
    -----END PUBLIC KEY-----
  fulcioCert: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----
  ...

```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Configuration example for a keyless signature validator using cosign, specifying issuer regex and subject.

```yaml
- name: keylessvalidator
  type: cosign
  trustRoots:
  - name: keyless
    keyless:
      issuerRegex: "github"
      subject: "philipp.belitz@securesystems.de
```

--------------------------------

### Labeling namespaces for validation

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/features/namespaced_validation.md

Example commands to label namespaces for either ignoring or validating them with Connaisseur.

```bash
# either
kubectl namespaces <namespace> securesystemsengineering.connaisseur/webhook=ignore
# or
kubectl namespaces <namespace> securesystemsengineering.connaisseur/webhook=validate
```

--------------------------------

### Environment Variables for Other KMS Providers

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Example configuration in values.yaml for injecting environment variables for KMS authentication, such as for Vault.

```yaml
charts/connaisseur/values.yaml
  envs:
    VAULT_ADDR: myvault.com
    VAULT_TOKEN: secrettoken
```

--------------------------------

### Verify Connaisseur Deployment Status

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/getting_started.md

Displays the expected output after a successful Helm installation and the status of running pods and services.

```bash
NAME: connaisseur
LAST DEPLOYED: Fri Jul  9 20:43:10 2021
NAMESPACE: connaisseur
STATUS: deployed
REVISION: 1
TEST SUITE: None
```

```bash
NAME                                          READY   STATUS    RESTARTS   AGE
pod/connaisseur-deployment-6876c87c8c-txrkj   1/1     Running   0          2m9s
pod/connaisseur-deployment-6876c87c8c-wvr7q   1/1     Running   0          2m9s
pod/connaisseur-deployment-6876c87c8c-rnc7k   1/1     Running   0          2m9s

NAME                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
service/connaisseur-svc   ClusterIP   10.152.183.166   <none>        443/TCP   2m10s

NAME                                     READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/connaisseur-deployment   3/3     3            3           2m9s

NAME                                                DESIRED   CURRENT   READY   AGE
replicaset.apps/connaisseur-deployment-6876c87c8c   3         3         3       2m9s
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/features/alerting.md

Example alerting configuration for receiving notifications in Keybase whenever Connaisseur admits a request to your cluster.

```yaml
alerting:
  admitRequest:
    receivers:
      - template: keybase
        receiverUrl: https://bots.keybase.io/webhookbot/<Your-Keybase-Hook-Token>
```

--------------------------------

### Output of pushing an image with DCT enabled

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notaryv1.md

This is an example of the output when pushing an image with DCT enabled, including prompts for creating new root and repository key passphrases.

```bash
The push refers to repository [<your-repo>/busybox]
5b8c72934dfc: Pushed
stable: digest: sha256:dca71257cd2e72840a21f0323234bb2e33fea6d949fa0f21c5102146f583486b size: 527
Signing and pushing trust metadata
You are about to create a new root signing key passphrase. This passphrase
will be used to protect the most sensitive key in your signing system. Please
choose a long, complex passphrase and be careful to keep the password and the
key file itself secure and backed up. It is highly recommended that you use a
password manager to generate the passphrase and keep it safe. There will be no
way to recover this key. You can find the key in your config directory.
Enter passphrase for new root key with ID 5fb3e1e:
Repeat passphrase for new root key with ID 5fb3e1e:
Enter passphrase for new repository key with ID 6c2a04c:
Repeat passphrase for new repository key with ID 6c2a04c:
Finished initializing "<your-repo>/busybox"
```

--------------------------------

### Kubernetes Secret Configuration for KMS

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Example configuration in values.yaml for using a Kubernetes secret as a trust root key for Cosign.

```yaml
charts/connaisseur/values.yaml
- name: myvalidator
  type: cosign
  trustRoots:
  - name: mykey
    key: k8s://connaisseur/cosignkeys
```

--------------------------------

### Create a trust policy JSON

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notation.md

Example JSON content for a trust policy used by Notation to match images to their verification keys.

```json
{
    "version": "1.0",
    "trustPolicies": [
        {
            "name": "my-images",
            "registryScopes": [ "*" ],
            "signatureVerification": {
                "level" : "strict"
            },
            "trustStores": [ "ca:mykey" ],
            "trustedIdentities": [
                "*"
            ]
        }
    ]
}
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notation.md

Example configuration for adding Bitnami's public root certificate as a trust root for the Notation validator in Connaisseur.

```yaml
application:
  validators:
  - name: bitnami_notation
    type: notation
    trustRoots:
    - name: bitnami
      cert: |
        -----BEGIN CERTIFICATE-----
        MIIGdDCCBFygAwIBAgIUDBaWhJB62sRxczoYu1AcuyKzx9gwDQYJKoZIhvcNAQEL
        BQAwdjELMAkGA1UEBhMCVVMxFTATBgNVBAoMDFZNd2FyZSwgSW5jLjEjMCEGA1UE
        CwwaVk13YXJlIEFwcGxpY2F0aW9uIENhdGFsb2cxKzApBgNVBAMMIlZNd2FyZSBB
        cHBsaWNhdGlvbiBDYXRhbG9nIFJvb3QgQ0EwHhcNMjMxMTA2MTUzMDM0WhcNNDMx
        MTAyMTUzMDM0WjB2MQswCQYDVQQGEwJVUzEVMBMGA1UECgwMVk13YXJlLCBJbmMu
        MSMwIQYDVQQLDBpWTXdhcmUgQXBwbGljYXRpb24gQ2F0YWxvZzErMCkGA1UEAwwi
        Vk13YXJlIEFwcGxpY2F0aW9uIENhdGFsb2cgUm9vdCBDQTCCAiIwDQYJKoZIhvcN
        AQEBBQADggIPADCCAgoCggIBAKa8IGkj5z0TDXV0MmHOBpCcl+Prnr+PR1qM44O5
        tJtw0Uniaka3Vttp4E+M5rbKqjd/neWwClaJWT3Fg2HC7vi4G0QhauZiuaob4hBc
        2DSPJd7/x3T+CIvu6CC3gCLcMJCEYE5mBoCFEiDeiqlHHzf4SI2e6RFJtv+dC7Oc
        Jj7BgccZvZXHeL4qHQs+zGU/oGyK+Iwn7mHnJp8rmDEHaHTbtXDeTqbxcPPJurDT
        trAW/HfrohCoRMZuZBBgf9s876XgoNz8b8FIQksA8OOTgLQdgDaqDAql+ddZzsrk
        l7VhFkztpinrynKpiz2FtlNfOaaD6rq3hpvbYMe3LkJdqw9cr64H2qGf1/Lx+SEh
        rxBwCcs1tmD8LfK4X1Io4JBDMmwfwZ70NdNqxmCxp6y03F52tAhr1DjvEPVXmBgL
        qdPdmpjNMFgPcjMniTBUfQczsy7UNDlmIUvEVNUQISP3KYFJFV4UOWZ+Kpdf1UPY
        95r/JPlRgJKVQ973EvUPlDkSAlY476L46C+jpZNUf6qm352Mf/VMhoSvAXKCYEzj
        WCf46x4nVRCXTR+StapUy5Ru5Azeo0/BXxTErtHatvGA8+igHD4Sn98MiHDO7gXt
        G9eBzIFPx3jyOIQPFhwujHR+8jA/Y9Z5k3T5C6VNpVRZGG7kW3p5gYCM5yq9cCyB
        tm7nAgMBAAGjgfkwgfYwHQYDVR0OBBYEFA22F2MbRn7kx4J5/ZppgpvCKBqhMIGz
        BgNVHSMEgaswgaiAFA22F2MbRn7kx4J5/ZppgpvCKBqhoXqkeDB2MQswCQYDVQQG
        EwJVUzEVMBMGA1UECgwMVk13YXJlLCBJbmMuMSMwIQYDVQQLDBpWTXdhcmUgQXBw
        bGljYXRpb24gQ2F0YWxvZzErMCkGA1UEAwwiVk13YXJlIEFwcGxpY2F0aW9uIENh
        dGFsb2cgUm9vdCBDQYIUDBaWhJB62sRxczoYu1AcuyKzx9gwDwYDVR0TAQH/BAUw
        AwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBAGOdQSsRNipU
        dZIL/K5fqbgjdYwafpgdjF8z1r9yLKWIEuCCiQFqRZ1CzjnP4jnIlYJXqvqpwklA
        AE56ZNvjo4LzOkElA4emEa+GmLSQ4CqXn+iwX1DYwkyVP7rgZ+k8kjSFjIF2rDhz
        dqnqHA1eyUyb3PhmDFY2694bhWv7D76MzGKLZOFBg3ar0khQp5VaI/bHW1nALAAd
        paM7uAQW/6I20McETtON0weCvbTuljuIVGADLOGwQwjsn7kHbrldEr0EIbtdiEPb
        2Ohis50tPyfrtKVKP/gZBsyTHMaiYxkiNacEDB+cdeDi6kH1Vmm3EFSXWX3vs30D
        3A8AnXw6L7YbXk4PnRy2ueIrs6bya5B9PSzbA2+gEzGnWpZsZmo85DmgpulSSOCM
        lzsP/72ikru888yR0Mvf6BgGestpuXfSSNqUYUTcZVwetyMx/1UC1yCapLJN6eu4
        0oPiQGhSv2uyu6070ne4kXkZL+DYQIjIzqUhS+4AFhBM7drKpo/9gWtHrTq4NRI1
        Q5mnf3lzlPxKV8Uyu2LzdwGb7ySFogAH5/1BGwWVbJvuV+GozJ/AzoPGsNE7mRHu
        ijySwgpMy1PoslxC6UhAeY6IdzoqS1PPQzinknikc4XvG7GLZUwtTooOyHx/ofQo
        RlcLAokhium7GrRC8aceTPeaZHW1+ewh
        -----END CERTIFICATE-----

```

--------------------------------

### Upgrade Connaisseur via Helm (Git repo)

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Command to upgrade Connaisseur using Helm when installed from a Git repository.

```bash
helm upgrade connaisseur helm -n connaisseur --wait
```

--------------------------------

### Getting the public root key using the pre-built image

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notaryv1.md

This command uses a pre-built Docker image to extract the public root key for a specified image.

```bash
# pre-built
docker run --rm docker.io/securesystemsengineering/get-public-root-key -i securesystemsengineering/testimage
```

--------------------------------

### Example configuration for namespaced validation

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/features/namespaced_validation.md

YAML configuration snippet for enabling and setting the mode of namespaced validation in Connaisseur.

```yaml
application:
  features:
    namespacedValidation:
      mode: validate
```

--------------------------------

### RBAC Configuration for Kubernetes Secret Access

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Example Role and RoleBinding to grant Connaisseur access to Kubernetes secrets for KMS integration.

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: connaisseur-kms-role
  namespace: connaisseur  # namespace of respective k8s secret, might have to change that
  labels:
    app.kubernetes.io/name: connaisseur
rules:
- apiGroups: ["*"]
  resources: ["secrets"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: connaisseur-kms-rolebinding
  namespace: connaisseur  # namespace of respective k8s secret, might have to change that
  labels:
    app.kubernetes.io/name: connaisseur
subjects:
- kind: ServiceAccount
  name: connaisseur-serviceaccount
  namespace: connaisseur  # Connaisseur's namespace, might have to change that
roleRef:
  kind: Role
  name: connaisseur-kms-role
  apiGroup: rbac.authorization.k8s.io
```

--------------------------------

### Multi-signature verification configuration with trust roots

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Example YAML configuration for the Connaisseur validator to enable multi-signature verification using Cosign, defining multiple trust roots.

```yaml
application:
  validators:
  - name: multicosigner
    type: cosign
    trustRoots:
    - name: alice
      key: |
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEusIAt6EJ3YrTHdg2qkWVS0KuotWQ
        wHDtyaXlq7Nhj8279+1u/l5pZhXJPW8PnGRRLdO5NbsuM6aT7pOcP100uw==
        -----END PUBLIC KEY-----
    - name: bob
      key: |
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE01DasuXJ4rfzAEXsURSnbq4QzJ6o
        EJ2amYV/CBKqEhhl8fDESxsmbdqtBiZkDV2C3znIwV16SsJlRRYO+UrrAQ==
        -----END PUBLIC KEY-----
    - name: charlie
      key: |
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEHBUYJVrH+aFYJPuryEkRyE6m0m4
        ANj+o/oW5fLRiEiXp0kbhkpLJR1LSwKYiX5Toxe3ePcuYpcWZn8Vqe3+oA==
        -----END PUBLIC KEY-----
```

--------------------------------

### Connaisseur values.yaml configuration for Cosign validator

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Example configuration for charts/connaisseur/values.yaml showing how to define a Cosign validator with trust roots and a policy.

```yaml
application:
  validators:
  - name: myvalidator
    type: cosign
    trustRoots:
    - name: mykey
      key: |
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvtc/qpHtx7iUUj+rRHR99a8mnGni
        qiGkmUb9YpWWTS4YwlvwdmMDiGzcsHiDOYz6f88u2hCRF5GUCvyiZAKrsA==
        -----END PUBLIC KEY-----

  policy:
  - pattern: "docker.io/securesystemsengineering/testimage:co-*"
    validator: myvalidator
    with:
      key: mykey

```

--------------------------------

### Preview documentation locally

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/CONTRIBUTING.md

Serve the documentation site locally using the mkdocs-material Docker image.

```bash
docker run --rm -it -p 8000:8000 -v ${PWD}:/docs squidfunk/mkdocs-material
```

--------------------------------

### Getting the public root key using a self-built image

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notaryv1.md

This command uses a self-built Docker image to extract the public root key for a specified image.

```bash
# or self-built
docker run --rm get-public-root-key -i securesystemsengineering/testimage
```

--------------------------------

### Deploy core resources

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Applies the core Connaisseur resources.

```bash
kubectl apply -f deploy.yaml -l "app.kubernetes.io/component=connaisseur-core" -n connaisseur
```

--------------------------------

### Signing with Notation

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/RELEASING.md

Signs the multi-arch image using the Notation CLI.

```bash
notation sign --key "sse" docker.io/securesystemsengineering/connaisseur@sha256:${SHA}
```

--------------------------------

### Render Kubernetes manifests from Helm templates

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Renders Kubernetes resources from Helm templates into a single 'deploy.yaml' file.

```bash
helm template helm -n connaisseur > deploy.yaml
```

--------------------------------

### Add a new version tag

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/RELEASING.md

Use this command on the develop branch to tag the new release version.

```bash
git tag v<new-connaisseur-version>
```

```bash
git tag v1.4.6
```

--------------------------------

### Run a Test Image Signed with a Different Key

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Kubectl command to run a test image signed with an alternative key.

```bash
kubectl run altsigned --image=docker.io/securesystemsengineering/testimage:co-signed-alt
```

--------------------------------

### Prepare Test Image

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/getting_started.md

Pulls and tags a test image for verification purposes.

```bash
# Typically, IMAGE=<REGISTRY>/<REPOSITORY-NAME>/<IMAGE-NAME>:<TAG>, like
IMAGE=docker.io/securesystemsengineering/demo:test
docker pull hello-world
docker image tag hello-world ${IMAGE}
docker push ${IMAGE}
```

--------------------------------

### Signing with Notary

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/RELEASING.md

Signs the multi-arch image using the Notary CLI.

```bash
notary -s "https://notary.docker.io" -d "${HOME}/.docker/trust" addhash \
  "docker.io/securesystemsengineering/connaisseur" \
  "${TAG}" \
  "${SIZE}" \
  --sha256 "${SHA}" \
  --roles "targets/releases" \
  --publish
```

--------------------------------

### Test Unsigned Image Deployment

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/getting_started.md

Attempts to run an unsigned image, which should be denied by the Connaisseur admission webhook.

```bash
kubectl run test --image=${IMAGE}
```

```bash
Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: Unable to get root trust data from default.
# or
Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: No trust data for image "docker.io/securesystemsengineering/demo:test".
# or
Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: could not find signed digest for image "docker.io/securesystemsengineering/demo:test" in trust data.
```

--------------------------------

### Create target namespace

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Creates the 'connaisseur' namespace for the deployment.

```bash
kubectl create namespace connaisseur
```

--------------------------------

### charts/connaisseur/values.yaml

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notaryv1.md

Example configuration for the Notary v1 validator in Connaisseur's values.yaml file.

```yaml
application:
  validators:
  - name: docker_essentials
    type: notaryv1
    host: notary.docker.io
    trustRoots:
    - name: sse
      key: |
        -----BEGIN PUBLIC KEY-----
        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvtc/qpHtx7iUUj+rRHR99a8mnGni
        qiGkmUb9YpWWTS4YwlvwdmMDiGzcsHiDOYz6f88u2hCRF5GUCvyiZAKrsA==
        -----END PUBLIC KEY-----

  policy:
  - pattern: "docker.io/securesystemsengineering/connaisseur:*"
    validator: docker_essentials
    with:
      key: sse
      delegations:
      - belitzphilipp
      - starkteetje

```

--------------------------------

### Signing with Cosign

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/RELEASING.md

Signs the multi-arch image using Cosign with a local key file.

```bash
cosign sign --key "${HOME}/.config/cosign/sse.key" securesystemsengineering/connaisseur@sha256:${SHA}
```

--------------------------------

### Verify Signed Image Deployment

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/getting_started.md

Attempts to run the signed image and confirms successful admission.

```bash
kubectl run test --image=${IMAGE}
```

```bash
pod/test created
```

--------------------------------

### Rebase commits for signing

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/CONTRIBUTING.md

Initiate an interactive rebase to modify and sign previous commits.

```bash
git rebase -i master
```

--------------------------------

### Connaisseur values.yaml policy configuration

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notation.md

Example configuration snippet for `.application.policy` in `charts/connaisseur/values.yaml` to match a repository with the Notation validator.

```yaml
- pattern: "docker.io/myrepo/*:*"
  validator: mynotation
```

--------------------------------

### Enable Automatic Child Approval

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/features/automatic_child_approval.md

Example configuration in `charts/connaisseur/values.yaml` to enable automatic child approval.

```yaml
application:
  features:
    automaticChildApproval: true
```

--------------------------------

### Delete Connaisseur via Helm (Git repo)

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Command to uninstall Connaisseur using Helm when installed from a Git repository.

```bash
helm uninstall connaisseur -n connaisseur
```

--------------------------------

### Clone Connaisseur Repository

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/README.md

Download the source code to access the Helm charts and configuration files.

```bash
git clone https://github.com/sse-secure-systems/connaisseur.git
```

--------------------------------

### Build and push multi-architecture Docker image

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/RELEASING.md

Builds the Connaisseur Docker image for multiple architectures and pushes them to the registry.

```makefile
make docker-multiarch
```

--------------------------------

### Run local linters

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/CONTRIBUTING.md

Execute security and code quality checks using gosec and golangci-lint via Docker containers.

```bash
docker run --rm -v $(pwd):/app -w /app/cmd/connaisseur securego/gosec gosec ./...
docker run --rm -v $(pwd):/app -w /app golangci/golangci-lint golangci-lint run -v --timeout=10m --skip-dirs="test"
```

--------------------------------

### Run an Unsigned Test Image

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Kubectl command to run an unsigned test image for comparison.

```bash
kubectl run unsigned --image=docker.io/securesystemsengineering/testimage:co-unsigned
```

--------------------------------

### Run a Signed Test Image

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Kubectl command to run a signed test image for verification.

```bash
kubectl run signed --image=docker.io/securesystemsengineering/testimage:co-signed
```

--------------------------------

### Connaisseur Policy with Delegations

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notaryv1.md

Example of a Connaisseur values.yaml configuration to enforce specific delegation signers for an image pattern.

```yaml
application:
  policy:
  - pattern: "<your-repo>/busybox:*"
    with:
      delegations:
      - <key-name>
      - <other-key-name>
```

--------------------------------

### Makefile Docker Build Command

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Command to build the Connaisseur container image using the Makefile.

```bash
make docker
```

--------------------------------

### Arm the webhook

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Applies the admission webhook resources for Connaisseur.

```bash
kubectl apply -f deploy.yaml -l "app.kubernetes.io/component=connaisseur-webhook" -n connaisseur
```

--------------------------------

### Kubernetes Secret for K8s keychain

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/sigstore_cosign.md

Example Kubernetes Secret definition for storing environment variables used by k8schain for authentication.

```yaml
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: connaisseur-env-secrets
  ...
data:
  AWS_ACCESS_KEY_ID: ***
  AWS_SECRET_ACCESS_KEY: ***
  ...

```

--------------------------------

### Connaisseur values.yaml configuration for Notation validator

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notation.md

Example configuration snippet for `charts/connaisseur/values.yaml` to integrate Notation as a validator, including trust roots.

```yaml
- name: mynotation
  type: notation
  trustRoots:
    - name: default
      cert: |
        -----BEGIN CERTIFICATE-----
        MIIDrjCCApagAwIBAgIUfA/t/J6eINSu566aAozkOjQKey4wDQYJKoZIhvcNAQEL
        BQAwbDELMAkGA1UEBhMCREUxDzANBgNVBAgMBkJlcmxpbjEPMA0GA1UEBwwGQmVy
        # ... rest of your certificate ...
        -----END CERTIFICATE-----
```

--------------------------------

### Clone the Connaisseur repository

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/CONTRIBUTING.md

Initial step to obtain the source code for local development.

```bash
git clone git@github.com:sse-secure-systems/connaisseur.git
```

--------------------------------

### Makefile Upgrade Command

Source: https://github.com/sse-secure-systems/connaisseur/blob/master/docs/basics.md

Command to upgrade Connaisseur using the Makefile.

```bash
make upgrade
```
Tokens:
Raw