Red Hat OpenShift Container Platform

Enabling signature verification for Red Hat Container Registries

To verify the integrity of the images in the Red Hat Container Registries, you can enable container signature validation for Red Hat Container Registries by writing a signature verification policy file specifying the keys to verify images from these registries.

For RHEL8 nodes, the registries are already defined in /etc/containers/registries.d by default.

Procedure

Create a Butane config file, 51-worker-rh-registry-trust.bu, containing the necessary configuration for the worker nodes.

The Butane version you specify in the config file should match the Red Hat OpenShift Container Platform version and always ends in 0. For example, {product-version}.0. See "Creating machine configs with Butane" for information about Butane.

variant: openshift
version: {product-version}.0
metadata:
  name: 51-worker-rh-registry-trust
  labels:
    machineconfiguration.openshift.io/role: worker
storage:
  files:
  - path: /etc/containers/policy.json
    mode: 0644
    overwrite: true
    contents:
      inline: |
        {
          "default": [
            {
              "type": "insecureAcceptAnything"
            }
          ],
          "transports": {
            "docker": {
              "registry.access.redhat.com": [
                {
                  "type": "signedBy",
                  "keyType": "GPGKeys",
                  "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
                }
              ],
              "registry.redhat.io": [
                {
                  "type": "signedBy",
                  "keyType": "GPGKeys",
                  "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
                }
              ]
            },
            "docker-daemon": {
              "": [
                {
                  "type": "insecureAcceptAnything"
                }
              ]
            }
          }
        }

Use Butane to generate a machine config YAML file, 51-worker-rh-registry-trust.yaml, containing the file to be written to disk on the worker nodes:
```
$ butane 51-worker-rh-registry-trust.bu -o 51-worker-rh-registry-trust.yaml
```

Apply the created machine config:

$ oc apply -f 51-worker-rh-registry-trust.yaml

Check that the worker machine config pool has rolled out with the new machine config:

Check that the new machine config was created:

$ oc get mc

Sample output

NAME                                               GENERATEDBYCONTROLLER                      IGNITIONVERSION   AGE
00-master                                          a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             25m
00-worker                                          a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             25m
01-master-container-runtime                        a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             25m
01-master-kubelet                                  a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             25m
01-worker-container-runtime                        a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             25m
01-worker-kubelet                                  a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             25m
51-master-rh-registry-trust                                                                   3.5.0             13s
51-worker-rh-registry-trust                                                                   3.5.0             53s
99-master-generated-crio-seccomp-use-default                                                  3.5.0             25m
99-master-generated-registries                     a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             25m
99-master-ssh                                                                                 3.2.0             28m
99-worker-generated-crio-seccomp-use-default                                                  3.5.0             25m
99-worker-generated-registries                     a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             25m
99-worker-ssh                                                                                 3.2.0             28m
rendered-master-af1e7ff78da0a9c851bab4be2777773b   a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             8s
rendered-master-cd51fd0c47e91812bfef2765c52ec7e6   a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             24m
rendered-worker-2b52f75684fbc711bd1652dd86fd0b82   a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             24m
rendered-worker-be3b3bce4f4aa52a62902304bac9da3c   a2178ad522c49ee330b0033bb5cb5ea132060b0a   3.5.0             48s

where:

51-worker-rh-registry-trust: Specifies the new machine config.
rendered-worker-be3b3bce4f4aa52a62902304bac9da3c: Specifies the new rendered machine config.

Check that the worker machine config pool is updating with the new machine config:

$ oc get mcp

Sample output

NAME     CONFIG                                             UPDATED   UPDATING   DEGRADED   MACHINECOUNT   READYMACHINECOUNT   UPDATEDMACHINECOUNT   DEGRADEDMACHINECOUNT   AGE
master   rendered-master-af1e7ff78da0a9c851bab4be2777773b   True      False      False      3              3                   3                     0                      30m
worker   rendered-worker-be3b3bce4f4aa52a62902304bac9da3c   False     True       False      3              0                   0                     0                      30m

When the UPDATING field is True, the machine config pool is updating with the new machine config. When the field becomes False, the worker machine config pool has rolled out to the new machine config.

If your cluster uses any RHEL7 worker nodes, when the worker machine config pool is updated, create YAML files on those nodes in the /etc/containers/registries.d directory, which specify the location of the detached signatures for a given registry server. The following example works only for images hosted in registry.access.redhat.com and registry.redhat.io.
1. Start a debug session to each RHEL7 worker node:
  $ oc debug node/<node_name>
2. Change your root directory to /host:
  sh-4.2# chroot /host
3. Create a /etc/containers/registries.d/registry.redhat.io.yaml file that contains the following:
  docker: registry.redhat.io: sigstore: https://registry.redhat.io/containers/sigstore
4. Create a /etc/containers/registries.d/registry.access.redhat.com.yaml file that contains the following:
  docker: registry.access.redhat.com: sigstore: https://access.redhat.com/webassets/docker/content/sigstore
5. Exit the debug session.