Can disable mutating image tags to digest after signature verification

[tianlang8158]

Can I check is there a way to disable mutating image tag to digest after signature verification passed?
The problem is ArgoCD identified the resource as "not sync-ed" as there is a different in Image between live manifest and desired manifest.

[xopham]

hey @tianlang8158 👋 that is currently not implemented, but could be picked up as an option for the future. For argoCD it may work to disable Automatic Child Approval. Could you check that?

I would like to understand clearly which behavior you'd want to have: When applying an image myimg:mytag that would typically be reviewed and exchanged for a trusted digest myimg@sha256:78a85c.... This is done since only a digest can really be signed and validated, as it is an inherent property of the image (somewhat described in the docs). Since the image then contains the digest after admission, the container runtime will verify that it downloads only the image of the trusted digest that allows verifying the image content. (Note: specifically cosign does not maintain any tag to digest relation in its signature format, while nv1 does)
If I understand correctly, you propose to validate myimg:mytag but not modify it. So essentially, Connaisseur would attest that there exists a signed digest for the given tag, but there is no certainty that this will be the actual digest that is rolled out: time of check vs time of use, a tag can have multiple digests.
As a result, I'd think that not mutating the tag to digest will be less secure, but not unreasonable when compared to no signatures. If we'd wanted to do that, we could add a flag that allows to either not mutate the tag during admission or add set connaisseur to validating admission webhook. I'd be open to do that if we add a suitable disclaimer.
Let me know if that properly describes the situation 🙏

Long-term, it may make sense to then just validate the actually running digests during runtime...

[tianlang8158]

Hi @xopham, we have tested even when Automatic child approval disabled, the sync status is still shown as "outofSync" as the image tags getting mutated after admission.

The desired behavior is that Connaissur has an option to disable image tag mutation after the image tag get verified that there is an existing signature stored in the registry which matching the image digest (for Cosign).

For now we have build a customized connaisseur image to disable to mutation step from source code as a workaround, hopefully connaisseur will address this issue in future updates..

[xopham]

@tianlang8158 thanks for letting me know. Would you care to share the changes you made?

Think there is 2 options:

• disable image tag mutation in source code
• allow setting connaisseur to a validating webhook

[xopham]

The resulting topic was already addressed in #270 . Would propose to move further discussion there. If that is fine with you, please mark as resolved 🙂

[xopham]

@tianlang8158 there is now a test version available: #270 (comment)

Please let me know if that works for you 🙏

[xopham]

@tianlang8158 btw a more secure solution would be to directly use digests for image references in contrast to tags. Otherwise some of the security benefits of a signature are lost

[phbelitz]

This is implemented in the golang version of Connaisseur.

There is a with.mode config option for each policy rule where this validation mode can be set to insecureValidateOnly (see here). HOWEVER, the better solution for the ArgoCD problem is the Resource Validation Mode, which you should set to podsOnly.

Cheers 🎉