ImageVerificationConfig

ImageVerificationConfig configures image signature verification policy.

apiVersion: v1alpha1
kind: ImageVerificationConfig
# List of verification rules.
rules:
    - image: registry.k8s.io/* # Image reference pattern to match for this rule.
      # Keyless verifier configuration to use for this rule.
      keyless:
        issuer: https://accounts.google.com # OIDC issuer URL for keyless verification.
        subject: [e-mail] # Expected subject for keyless verification.

        # # Regex pattern for subject matching.
        # subjectRegex: .*@example\.com
    - image: my-registry.example.com/* # Image reference pattern to match for this rule.
      # Public key verifier configuration to use for this rule.
      publicKey:
        certificate: |- # A public certificate in PEM format accepted for image signature verification.
            -----BEGIN CERTIFICATE-----
            MII--Sample Value--
            -----END CERTIFICATE-----
    - image: localhost:3000/* # Image reference pattern to match for this rule.
      deny: true # Deny pulling images matching the pattern (default: false).

Field	Type	Description	Value(s)
rules	ImageVerificationRuleV1Alpha1	List of verification rules. Rules are evaluated in order; first matching rule applies.

rules[]

ImageVerificationRuleV1Alpha1 defines a verification rule.

Field	Type	Description	Value(s)
image	string	Image reference pattern to match for this rule. Supports glob patterns, matches only on the image registry and repository, not on the tag or digest. The pattern is matched against the normalized image reference, which always starts with a registry domain: docker.io/library/nginx* matches nginx:latest, while library/nginx* matches nothing. The Docker Hub domain is always normalized to docker.io, so a pattern written against index.docker.io or registry-1.docker.io matches the same images a docker.io one does.
skip	bool	Skip verification for this image pattern (default: false).
deny	bool	Deny pulling images matching the pattern (default: false).
keyless	ImageKeylessVerifierV1Alpha1	Keyless verifier configuration to use for this rule.
publicKey	ImagePublicKeyVerifierV1Alpha1	Public key verifier configuration to use for this rule.

keyless

ImageKeylessVerifierV1Alpha1 configures a signature verification provider using Cosign keyless verification.

Field	Type	Description	Value(s)
issuer	string	OIDC issuer URL for keyless verification.
subject	string	Expected subject for keyless verification. This is the identity (email, URI) that signed the image.
subjectRegex	string	Regex pattern for subject matching. Use this instead of subject for flexible matching.

publicKey

ImagePublicKeyVerifierV1Alpha1 configures a signature verification provider using a static public key.

Field	Type	Description	Value(s)
certificate	string	A public certificate in PEM format accepted for image signature verification.