config-image-policies.yaml

# Copyright 2022 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-image-policies
  namespace: cosign-system
  labels:
    cosigned.sigstore.dev/release: devel

data:
  _example: |
    ################################
    #                              #
    #    EXAMPLE CONFIGURATION     #
    #                              #
    ################################
    cluster-image-policy-0: |
      images:
      - glob: rando
      authorities:
      - name: attestation-0
        key:
          data: inlinedata here
      - name: attestation-1
        key:
          kms: whatevs
    cluster-image-policy-1: |
      images:
      - glob: randomstuff*
      authorities:
      - name: attestation-0
        key:
          data: otherinline here
    cluster-image-policy-2: |
      images:
      - glob: rando3
      authorities:
      - name: attestation-0
        keyless:
          ca-cert:
            data: cacert chilling here
          url: http://keylessurl.here
          identities:
          - issuer: issuer
            subject: subject
    cluster-image-policy-3: |
      images:
      - glob: inlinecert
      authorities:
      - name: attestation-0
        key:
          data: |-
            -----BEGIN PUBLIC KEY-----
            MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J
            RCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==
            -----END PUBLIC KEY-----
    cluster-image-policy-4: |
      images:
      - regex: .*regexstring.*
      authorities:
      - name: attestation-0
        key:
          data: |-
            -----BEGIN PUBLIC KEY-----
            MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J
            RCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==
            -----END PUBLIC KEY-----
    cluster-image-policy-5: |
      images:
      - regex: .*regexstringtoo.*
      authorities:
      - name: attestation-0
        key:
          data: inlinedata here
    cluster-image-policy-json: "{\"images\":[{\"glob\":\"ghcr.io/example/*\",\"regex\":\"\"}],\"authorities\":[{\"key\":{\"data\":\"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\\n-----END PUBLIC KEY-----\"}}]}"
    cluster-image-policy-with-policy-attestations: |
      images:
      - glob: withattestations
      authorities:
      - name: attestation-0
        keyless:
          ca-cert:
            data: cacert chilling here
          url: http://keylessurl.here
          identities:
          - issuer: issuer
            subject: subject
        attestations:
        - predicateType: vuln
          type: cue
          data: "test-cue-here"
      policy:
        type: cue
        data: "cip level cue here"
    cluster-image-policy-source-oci: |
      images:
      - regex: .*sourceocionly.*
      authorities:
      - name: attestation-0
        key:
          data: inlinedata here
        source:
        - oci: "example.registry.com/alternative/signature"
    cluster-image-policy-source-oci-signature-pull-secrets: |
      images:
      - regex: .*sourceocisignaturepullsecrets.*
      authorities:
      - name: attestation-0
        key:
          data: inlinedata here
        source:
        - oci: "example.registry.com/alternative/signature"
          signaturePullSecrets:
          - name: examplePullSecret