Skip to content

Latest commit

 

History

History
50 lines (36 loc) · 2.49 KB

cosign_policy_init.md

File metadata and controls

50 lines (36 loc) · 2.49 KB
Raw

cosign policy init

generate a new keyless policy.

Synopsis

init is used to generate a root.json policy for keyless signing delegation. This is used to establish a policy for a registry namespace, a signing threshold and a list of maintainers who can sign over the body section.

cosign policy init [flags]

Examples


  # extract public key from private key to a specified out file.
  cosign policy init -ns <project_namespace> --maintainers {email_addresses} --threshold <int> --expires <int>(days)

Options

      --allow-insecure-registry                                                                  whether to allow insecure connections to registries. Don't use this for anything but testing
      --attachment-tag-prefix [AttachmentTagPrefix]sha256-[TargetImageDigest].[AttachmentName]   optional custom prefix to use for attached image tags. Attachment images are tagged as: [AttachmentTagPrefix]sha256-[TargetImageDigest].[AttachmentName]
      --expires int                                                                              total expire duration in days
  -h, --help                                                                                     help for init
      --issuer string                                                                            trusted issuer to use for identity tokens, e.g. https://accounts.google.com
      --k8s-keychain                                                                             whether to use the kubernetes keychain instead of the default keychain (supports workload identity).
  -m, --maintainers strings                                                                      list of maintainers to add to the root policy
      --namespace string                                                                         registry namespace that the root policy belongs to (default "ns")
      --out string                                                                               output policy locally (default "o")
      --threshold int                                                                            threshold for root policy signers (default 1)

Options inherited from parent commands

      --output-file string   log output to a file
  -t, --timeout duration     timeout for commands (default 3m0s)
  -d, --verbose              log debug output
  -y, --yes                  skip confirmation prompts

SEE ALSO