mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-11-10 21:10:24 +00:00
Compare commits
12
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Cédric Verstraeten
|
cb8ce32992 | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
3c4f8335ee | ||
|
Cédric Verstraeten
|
c4227c44f9 | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
900e7a97e9 | ||
|
Cédric Verstraeten
|
9982557391 | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
e282793309 | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
0c56301d8e | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
876f91b033 | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
e79ce0fd4e | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
dcfcf28050 | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
49d6226a5d | ||
|
Cédric VerstraetenandClaude Opus 5.5
|
b0242acfd8 |
@@ -16,7 +16,7 @@ type: application
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.177.0
|
||||
version: 0.180.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
|
||||
+101
-1
@@ -335,6 +335,105 @@ ownership on existing optional `LOCAL_CACHE_DIRECTORY` mounts. Its liveness
|
||||
endpoint is `GET /api/health`. Wire those settings in the actual Vault deployment
|
||||
only when a compatible image release is selected; no migration is required.
|
||||
|
||||
### Image signature verification (Kyverno)
|
||||
|
||||
Starting with chart **`0.179.0`**, the chart can verify that UUG.AI images are
|
||||
signed by UUG.AI. It is **opt-in** from chart **`0.179.1`** (in `0.179.0` it was
|
||||
on by default):
|
||||
|
||||
```yaml
|
||||
imageVerification:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
When enabled and [Kyverno](https://kyverno.io) is installed in the cluster, it
|
||||
creates Kyverno policies in the release namespace. Without Kyverno (no
|
||||
`kyverno.io/v1` API), nothing is created even when enabled.
|
||||
|
||||
Each policy is a plain, namespaced Kyverno `Policy` in its own file in
|
||||
`templates/kyverno/`, so it applies only to the release namespace. There is one
|
||||
per `ghcr.io/uug-ai` image the chart can deploy; each requires the image to be
|
||||
signed for its own `uug-ai/<image>` repository. "Mode" is the
|
||||
`validationFailureAction` the policy uses:
|
||||
|
||||
| Template | Image | Releases signed | Mode |
|
||||
|---|---|---|---|
|
||||
| `hub-api-signed-images.yaml` | `ghcr.io/uug-ai/hub-api` | ✅ signed | value |
|
||||
| `hub-cleanup-signed-images.yaml` | `ghcr.io/uug-ai/hub-cleanup` | ✅ signed | value |
|
||||
| `hub-frontend-signed-images.yaml` | `ghcr.io/uug-ai/hub-frontend` | ✅ signed | value |
|
||||
| `hub-loitering-signed-images.yaml` | `ghcr.io/uug-ai/hub-loitering` | ✅ signed | value |
|
||||
| `hub-monitor-device-signed-images.yaml` | `ghcr.io/uug-ai/hub-monitor-device` | ✅ signed | value |
|
||||
| `hub-workflows-signed-images.yaml` | `ghcr.io/uug-ai/hub-workflows` | ✅ signed | value |
|
||||
| `hub-pipeline-analysis-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-analysis` | ✅ signed | value |
|
||||
| `hub-pipeline-counting-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-counting` | ✅ signed | value |
|
||||
| `hub-pipeline-monitor-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-monitor` | ✅ signed | value |
|
||||
| `hub-pipeline-sequence-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sequence` | ✅ signed | value |
|
||||
| `hub-pipeline-throttler-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-throttler` | ✅ signed | value |
|
||||
| `hub-audit-signed-images.yaml` | `ghcr.io/uug-ai/hub-audit` | ❌ not yet | always `Audit` |
|
||||
| `hub-objecttracking-signed-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` | ❌ not yet | always `Audit` |
|
||||
| `hub-vlm-signed-images.yaml` | `ghcr.io/uug-ai/hub-vlm` | ❌ not yet | always `Audit` |
|
||||
| `hub-pipeline-dominantcolors-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` | ❌ not yet | always `Audit` |
|
||||
| `hub-pipeline-event-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` | ❌ not yet | always `Audit` |
|
||||
| `hub-pipeline-export-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` | ❌ not yet | always `Audit` |
|
||||
| `hub-pipeline-notification-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` | ❌ not yet | always `Audit` |
|
||||
| `hub-pipeline-notification-test-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` | ❌ not yet | always `Audit` |
|
||||
| `hub-pipeline-sprite-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` | ❌ not yet | always `Audit` |
|
||||
| `hub-pipeline-thumbnail-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` | ❌ not yet | always `Audit` |
|
||||
|
||||
Images whose releases are not signed yet stay in `Audit` even when
|
||||
`imageVerification.validationFailureAction` is `Enforce`, so enabling
|
||||
`Enforce` never blocks them. Their repositories need `sign: true` (and
|
||||
`id-token: write`) in their release workflow; once their releases are signed,
|
||||
the policy file switches to the configured value in a chart release.
|
||||
|
||||
Not covered: `uugai/admin`, `uugai/hub-proxy` and
|
||||
`uugai/hub-reactivatesubscriptions` are pulled from Docker Hub rather than the
|
||||
signed `ghcr.io/uug-ai` releases, and `oauth2-proxy` is a third-party image.
|
||||
|
||||
To change a policy, edit its file. To add an image, copy a policy file and
|
||||
change the image and repository.
|
||||
|
||||
Every image is released with a keyless [cosign](https://docs.sigstore.dev)
|
||||
signature recorded in the public Rekor transparency log. A policy accepts an
|
||||
image only when its signature was:
|
||||
|
||||
- issued by GitHub Actions (`https://token.actions.githubusercontent.com`),
|
||||
- made by the UUG.AI release workflow
|
||||
(`uug-ai/workflows/.github/workflows/release-create.yml`), and
|
||||
- made **for the image's own repository** (for `hub-api`: `uug-ai/hub-api`).
|
||||
The release workflow is shared by all UUG.AI repositories, so this repository
|
||||
claim is what stops an image of one repository passing as another.
|
||||
|
||||
Signed means the image's releases are signed now; older tags of the same image
|
||||
can still be unsigned (for example `hub-api` `v1.11.38`) and are rejected in
|
||||
`Enforce`. Check the tags you run before enforcing.
|
||||
|
||||
By default the policies run in **`Audit`** mode: unsigned images are reported in
|
||||
Kyverno PolicyReports (for example in Policy Reporter) but still run. Once the
|
||||
reports are clean, block them:
|
||||
|
||||
```yaml
|
||||
imageVerification:
|
||||
enabled: true
|
||||
validationFailureAction: Enforce # Audit (default) or Enforce
|
||||
```
|
||||
|
||||
In both modes `failurePolicy: Ignore` keeps pods starting if Kyverno itself is
|
||||
unavailable, and `mutateDigest`/`verifyDigest: false` leave pod images as they
|
||||
are; those are set in the policy files.
|
||||
|
||||
The policies verify the images at `ghcr.io/uug-ai`. If you mirror the images to
|
||||
another registry, disable the chart's policies and apply your own copy with
|
||||
your registry in `imageReferences` (the mirror must also copy the cosign `.sig`
|
||||
artifacts). To check an image yourself:
|
||||
|
||||
```bash
|
||||
cosign verify ghcr.io/uug-ai/hub-api:v1.11.40 \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
--certificate-identity-regexp '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@' \
|
||||
--certificate-github-workflow-repository uug-ai/hub-api
|
||||
```
|
||||
|
||||
### MCP
|
||||
|
||||
Deploy a Hub API image supporting MCP, then enable the read-only Streamable HTTP
|
||||
@@ -1034,7 +1133,8 @@ kerberospipeline:
|
||||
| `kerberospipeline.analysis.tag` | The Docker image tag/version. | `"v1.7.8"` |
|
||||
| `kerberospipeline.analysis.replicas` | Number of replicas for `kerberospipeline.analysis`. | `1` |
|
||||
| `kerberospipeline.analysis.logLevel` | Log verbosity level for `kerberospipeline.analysis`. | `"info"` |
|
||||
| `kerberospipeline.analysis.thumbnailRegeneration.enabled` | Regenerate thumbnails from the first frame of a classified moving object (`THUMBNAIL_REGENERATION_ENABLED`). Adds one thumbnail job per classified recording. Requires an analysis image that reads the flag. | `false` |
|
||||
| `kerberospipeline.analysis.thumbnailRegeneration.enabled` | Regenerate thumbnails from the first frame of a classified moving object (`THUMBNAIL_REGENERATION_ENABLED`). Adds up to one thumbnail job per classified recording. Requires an analysis image that reads the flag. | `false` |
|
||||
| `kerberospipeline.analysis.thumbnailRegeneration.minSeconds` | Only regenerate when the classified object first appears at least this many seconds into the recording (`THUMBNAIL_REGENERATION_MIN_SECONDS`); earlier objects are already in the original thumbnail. `0` regenerates for every object. Requires an analysis image that reads the variable. | `3` |
|
||||
| `kerberospipeline.analysis.dbCache.enabled` | Cache hot-path MongoDB lookups (site vault per device) in memory. Site changes apply after at most one TTL. | `false` |
|
||||
| `kerberospipeline.analysis.dbCache.ttl` | Lifetime of a cached lookup, as a Go duration (e.g. `"30s"`, `"5m"`). | `"5m"` |
|
||||
| `kerberospipeline.analysis.resources.requests.memory` | Memory request for `kerberospipeline.analysis`. | `"10Mi"` |
|
||||
|
||||
@@ -129,6 +129,10 @@ spec:
|
||||
# Thumbnail regeneration from classified frames (opt-in)
|
||||
- name: THUMBNAIL_REGENERATION_ENABLED
|
||||
value: {{ .Values.kerberospipeline.analysis.thumbnailRegeneration.enabled | default false | quote }}
|
||||
# Skip regeneration when the object first appears within this many seconds
|
||||
- name: THUMBNAIL_REGENERATION_MIN_SECONDS
|
||||
{{- $regeneration := .Values.kerberospipeline.analysis.thumbnailRegeneration }}
|
||||
value: {{ ternary $regeneration.minSeconds 3 (hasKey $regeneration "minSeconds") | quote }}
|
||||
|
||||
# In-memory cache for hot-path MongoDB lookups
|
||||
- name: DB_CACHE_ENABLED
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-api images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-api.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-api-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-api images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-api pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-api
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-api:*"
|
||||
- "ghcr.io/uug-ai/hub-api@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-api's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-api
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-audit images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-audit.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-audit-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-audit images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-audit releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-audit
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-audit:*"
|
||||
- "ghcr.io/uug-ai/hub-audit@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-audit's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-audit
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-cleanup images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-cleanup.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-cleanup-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-cleanup images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-cleanup pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-cleanup
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-cleanup:*"
|
||||
- "ghcr.io/uug-ai/hub-cleanup@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-cleanup's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-cleanup
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-frontend images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-frontend.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-frontend-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-frontend images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-frontend pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-frontend
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-frontend:*"
|
||||
- "ghcr.io/uug-ai/hub-frontend@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-frontend's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-frontend
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-loitering images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-loitering.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-loitering-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-loitering images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-loitering pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-loitering
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-loitering:*"
|
||||
- "ghcr.io/uug-ai/hub-loitering@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-loitering's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-loitering
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-monitor-device images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-monitor-device.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-monitor-device-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-monitor-device images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-monitor-device pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-monitor-device
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-monitor-device:*"
|
||||
- "ghcr.io/uug-ai/hub-monitor-device@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-monitor-device's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-monitor-device
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-objecttracking images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-objecttracking.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-objecttracking-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-objecttracking images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-objecttracking releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-objecttracking pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-objecttracking
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-objecttracking:*"
|
||||
- "ghcr.io/uug-ai/hub-objecttracking@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-objecttracking's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-objecttracking
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-analysis images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-analysis.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-analysis-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-analysis images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-analysis pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-analysis
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-analysis:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-analysis@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-analysis's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-analysis
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-counting images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-counting.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-counting-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-counting images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-counting pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-counting
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-counting:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-counting@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-counting's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-counting
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-pipeline-dominantcolors images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-dominantcolors.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-dominantcolors-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-dominantcolors images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-pipeline-dominantcolors releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-dominantcolors pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-dominantcolors
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-dominantcolors:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-dominantcolors@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-dominantcolors's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-dominantcolors
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-pipeline-event images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-event.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-event-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-event images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-pipeline-event releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-event pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-event
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-event:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-event@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-event's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-event
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-pipeline-export images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-export.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-export-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-export images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-pipeline-export releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-export pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-export
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-export:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-export@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-export's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-export
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-monitor images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-monitor.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-monitor-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-monitor images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-monitor pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-monitor
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-monitor:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-monitor@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-monitor's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-monitor
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-pipeline-notification images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-notification.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-notification-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-notification images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-pipeline-notification releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-notification pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-notification
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-notification's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-notification
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-pipeline-notification-test images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-notification-test.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-notification-test-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-notification-test images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-pipeline-notification-test releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-notification-test pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-notification-test
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification-test:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-notification-test@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-notification-test's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-notification-test
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-sequence images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-sequence.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-sequence-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-sequence images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-sequence pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-sequence
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sequence:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sequence@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-sequence's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-sequence
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-pipeline-sprite images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-sprite.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-sprite-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-sprite images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-pipeline-sprite releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-sprite pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-sprite
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sprite:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-sprite@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-sprite's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-sprite
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-pipeline-throttler images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-throttler.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-throttler-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-throttler images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-throttler pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-throttler
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-throttler:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-throttler@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-throttler's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-throttler
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-pipeline-thumbnail images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-thumbnail.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-pipeline-thumbnail-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-pipeline-thumbnail images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-pipeline-thumbnail releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-pipeline-thumbnail pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-pipeline-thumbnail
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-pipeline-thumbnail:*"
|
||||
- "ghcr.io/uug-ai/hub-pipeline-thumbnail@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-pipeline-thumbnail's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-pipeline-thumbnail
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- /*
|
||||
hub-vlm images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-vlm.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-vlm-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-vlm images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Not signed yet: uug-ai/hub-vlm releases need `sign: true` (and
|
||||
# `id-token: write`) in their release workflow. Until then this policy stays
|
||||
# in Audit, even when imageVerification.validationFailureAction is Enforce.
|
||||
# Once signed, use the same line as hub-api-signed-images.yaml.
|
||||
validationFailureAction: Audit
|
||||
# Kyverno's default (Fail) would stop hub-vlm pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-vlm
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-vlm:*"
|
||||
- "ghcr.io/uug-ai/hub-vlm@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-vlm's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-vlm
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
hub-workflows images must be signed by UUG.AI: a keyless cosign signature issued by
|
||||
GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-workflows.
|
||||
A namespaced Policy, so it applies only to the release namespace.
|
||||
Rendered only when imageVerification.enabled is true and Kyverno is installed.
|
||||
*/ -}}
|
||||
{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: hub-workflows-signed-images
|
||||
annotations:
|
||||
policies.kyverno.io/title: hub-workflows images must be signed by UUG.AI
|
||||
policies.kyverno.io/category: Supply chain
|
||||
policies.kyverno.io/severity: high
|
||||
policies.kyverno.io/subject: Pod
|
||||
# Kyverno defaults apply: background scans of running pods, signature required.
|
||||
# Only settings whose Kyverno default would change behaviour are set below.
|
||||
spec:
|
||||
# Audit: report unsigned images, don't block. Enforce: reject the pod.
|
||||
validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
|
||||
# Kyverno's default (Fail) would stop hub-workflows pods starting while Kyverno is down.
|
||||
failurePolicy: Ignore
|
||||
# Verifying against GHCR and Rekor can exceed the 10s default.
|
||||
webhookTimeoutSeconds: 30
|
||||
rules:
|
||||
- name: verify-hub-workflows
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
verifyImages:
|
||||
- imageReferences:
|
||||
- "ghcr.io/uug-ai/hub-workflows:*"
|
||||
- "ghcr.io/uug-ai/hub-workflows@*"
|
||||
# Kyverno's defaults (true) would rewrite pod images to digests and
|
||||
# report every tag-based image; enable together with Enforce.
|
||||
mutateDigest: false
|
||||
verifyDigest: false
|
||||
attestors:
|
||||
- entries:
|
||||
- keyless:
|
||||
issuer: https://token.actions.githubusercontent.com
|
||||
# The UUG.AI release workflow, at a branch/tag ref or a commit.
|
||||
subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
|
||||
additionalExtensions:
|
||||
# That workflow signs for every UUG.AI repository; this
|
||||
# binds the signature to hub-workflows's own repository.
|
||||
githubWorkflowRepository: uug-ai/hub-workflows
|
||||
rekor:
|
||||
url: https://rekor.sigstore.dev
|
||||
{{- end }}
|
||||
@@ -22,6 +22,25 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"imageVerification": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"description": "Kyverno policies (templates/kyverno/) requiring UUG.AI images to be signed by UUG.AI. Created only when the cluster serves kyverno.io/v1.",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"description": "Create the policies when Kyverno is installed."
|
||||
},
|
||||
"validationFailureAction": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"Audit",
|
||||
"Enforce"
|
||||
],
|
||||
"description": "Audit reports unsigned images but lets them run; Enforce rejects them."
|
||||
}
|
||||
}
|
||||
},
|
||||
"deviceTags": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
|
||||
+17
-1
@@ -26,6 +26,18 @@ readOnly: false # Set to 'true' to halt all write operations to the database (e.
|
||||
# - ui: Hub services only
|
||||
mode: "all"
|
||||
###########################################################################
|
||||
# Image signature verification (Kyverno)
|
||||
###########################################################################
|
||||
# Kyverno policies in templates/kyverno/ (one file per ghcr.io/uug-ai image)
|
||||
# requiring UUG.AI images to be signed by UUG.AI. Opt-in: when enabled, they are
|
||||
# created only if Kyverno is installed.
|
||||
imageVerification:
|
||||
enabled: false
|
||||
# Audit: report unsigned images (PolicyReports) but let them run.
|
||||
# Enforce: reject pods whose image is unsigned or signed for another repository.
|
||||
# Images whose releases are not signed yet always stay in Audit (see README).
|
||||
validationFailureAction: Audit
|
||||
###########################################################################
|
||||
# Global configuration
|
||||
###########################################################################
|
||||
global:
|
||||
@@ -1413,10 +1425,14 @@ kerberospipeline:
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# Opt-in: after classification, re-enqueue the recording on the thumbnail
|
||||
# queue to regenerate its thumbnail from the first frame of a tracked moving
|
||||
# object (THUMBNAIL_REGENERATION_ENABLED). Adds one thumbnail job per
|
||||
# object (THUMBNAIL_REGENERATION_ENABLED). Adds up to one thumbnail job per
|
||||
# classified recording; size pipe-thumbnail accordingly before enabling.
|
||||
# minSeconds (THUMBNAIL_REGENERATION_MIN_SECONDS): only regenerate when the
|
||||
# object first appears at least this many seconds into the recording; earlier
|
||||
# objects are already in the original thumbnail. 0 regenerates for every object.
|
||||
thumbnailRegeneration:
|
||||
enabled: false
|
||||
minSeconds: 3
|
||||
# In-memory cache for hot-path MongoDB lookups (site vault per device).
|
||||
# Site changes apply after at most one TTL; each replica caches separately.
|
||||
dbCache:
|
||||
|
||||
Reference in New Issue
Block a user