[Cosigned] Add signature pull secrets

[DennyHoang]

Summary

• Add signaturePullSecrets to ClusterImagePolicy's Authorities sources.
• Allow users to define additional credentials for signature registry location. Previously, the same ImagePullSecret credentials used only therefore images and signatures needed to use the same credentials.

Ticket Link

Resolves #1655

Release Note

* Allow configurable signature pull secrets credentials for cosigned

Potential outstanding todo

• Add integration test scenario (Requiring more investigation from my end on how to set up credentials for locally spun up registry in our github workflow)

cc: @coyote240 @hectorj2f @vaikas

[codecov-commenter]

Codecov Report

Merging #1805 (350e17e) into main (db323cd) will increase coverage by 0.11%.
The diff coverage is 74.19%.

@@            Coverage Diff             @@
##             main    #1805      +/-   ##
==========================================
+ Coverage   32.73%   32.85%   +0.11%     
==========================================
  Files         147      147              
  Lines        9313     9346      +33     
==========================================
+ Hits         3049     3071      +22     
- Misses       5907     5919      +12     
+ Partials      357      356       -1     

Impacted Files	Coverage Δ
...apis/cosigned/v1alpha1/clusterimagepolicy_types.go	0.00% <ø> (ø)
...kg/apis/cosigned/v1alpha1/zz_generated.deepcopy.go	0.00% <0.00%> (ø)
...cosigned/v1alpha1/clusterimagepolicy_validation.go	94.30% <100.00%> (+0.18%)	⬆️
pkg/cosign/kubernetes/webhook/validator.go	77.70% <100.00%> (+0.39%)	⬆️
cmd/cosign/cli/verify/verify.go	0.00% <0.00%> (ø)
cmd/cosign/cli/verify/verify_attestation.go	0.00% <0.00%> (ø)
cmd/cosign/cli/fulcio/fulcioroots/fulcioroots.go	36.36% <0.00%> (+0.42%)	⬆️
pkg/cosign/verify.go	29.95% <0.00%> (+0.47%)	⬆️
cmd/cosign/cli/fulcio/fulcioverifier/ctl/verify.go	49.26% <0.00%> (+1.40%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update db323cd...350e17e. Read the comment docs.

[cpanato]

@DennyHoang this is ready for review?

[vaikas]

Thanks, we can fix the comment in a followup. Thanks for doing this!
Thinking about how we want to add e2e tests for this. Thinking that we can create a local image in the registry we spin up, but then maybe push the signatures / attestations to another registry and use a different secret for that then?

[vaikas]

Nit, we should document in the signature what namespace this is. It's the namespace where we allow the signature pull secrets to come from.

[hectorj2f]

+1

[hectorj2f]

lgtm