C 0236
ArmoBest
Severity
High
Description of the the issue
Verifies the signature of each image with given public keys or trusted keyless (Fulcio) identities. Note, this control is configurable. See below the details.
Related resources
CronJob, DaemonSet, Deployment, Job, Pod, ReplicaSet, StatefulSet
What does this control test
Verifies the signature of each image with given public keys or trusted keyless (Fulcio) identities. An image passes if either a trusted key or a trusted identity verifies it.
How to check it manually
Remediation
Replace the image with an image that is signed correctly
Impact Statement
Default Value
Configuration
This control can be configured using the following parameters. Read CLI/UI documentation about how to change parameters.
Trusted Cosign public keys
trustedCosignPublicKeys
A list of trusted Cosign public keys that are used for validating container image signatures.
Require Cosign transparency log entry
cosignRequireTransparencyLog
Whether a valid signature must also have a transparency log (Rekor) entry. Set to false to accept images signed with --tlog-upload=false.
Cosign Rekor URL
cosignRekorURL
URL of the Rekor transparency log used to look up signatures that have no Rekor bundle.
Trusted Cosign keyless identities
trustedCosignIdentities
Keyless (Fulcio) signers to trust, each an OIDC issuer regular expression and a certificate identity regular expression.
Example
No example