{{< highlight yaml >}} apiVersion: v1alpha1 kind: ImageVerificationConfig

List of verification rules.

rules: - image: registry.k8s.io/* # Image reference pattern to match for this rule. # Keyless verifier configuration to use for this rule. keyless: issuer: https://accounts.google.com # OIDC issuer URL for keyless verification. subject: [email protected] # Expected subject for keyless verification.

    # # Regex pattern for subject matching.
    # subjectRegex: .*@example\.com
- image: my-registry/* # Image reference pattern to match for this rule.
  # Public key verifier configuration to use for this rule.
  publicKey:
    certificate: |- # A public certificate in PEM format accepted for image signature verification.
        -----BEGIN CERTIFICATE-----
        MII--Sample Value--
        -----END CERTIFICATE-----
- image: locahost:3000/* # Image reference pattern to match for this rule.
  deny: true # Deny pulling images matching the pattern (default: false).

Field	Type	Description	Value(s)
`rules`	<a href="#ImageVerificationConfig.rules.">[]ImageVerificationRuleV1Alpha1</a>	List of verification rules.
Rules are evaluated in order; first matching rule applies.

rules[] {#ImageVerificationConfig.rules.}

ImageVerificationRuleV1Alpha1 defines a verification rule.

Field	Type	Description
`image`	string	Image reference pattern to match for this rule.
Supports glob patterns. <details><summary>Show example(s)</summary>{{< highlight yaml >}}
image: docker.io/library/nginx
{{< /highlight >}}{{< highlight yaml >}}
image: registry.k8s.io/*
{{< /highlight >}}</details>
`skip`	bool	Skip verification for this image pattern (default: false).
`deny`	bool	Deny pulling images matching the pattern (default: false).
`keyless`	<a href="#ImageVerificationConfig.rules..keyless">ImageKeylessVerifierV1Alpha1</a>	Keyless verifier configuration to use for this rule.
`publicKey`	<a href="#ImageVerificationConfig.rules..publicKey">ImagePublicKeyVerifierV1Alpha1</a>	Public key verifier configuration to use for this rule.

keyless {#ImageVerificationConfig.rules..keyless}

ImageKeylessVerifierV1Alpha1 configures a signature verification provider using Cosign keyless verification.

Field	Type	Description
`issuer`	string	OIDC issuer URL for keyless verification. <details><summary>Show example(s)</summary>{{< highlight yaml >}}
issuer: https://accounts.google.com
{{< /highlight >}}{{< highlight yaml >}}
issuer: https://token.actions.githubusercontent.com
{{< /highlight >}}</details>
`subject`	string	Expected subject for keyless verification.

Use this instead of subject for flexible matching. <details><summary>Show example(s)</summary>{{< highlight yaml >}} subjectRegex: .*@example.com {{< /highlight >}}</details> | |

publicKey {#ImageVerificationConfig.rules..publicKey}

ImagePublicKeyVerifierV1Alpha1 configures a signature verification provider using a static public key.

Field	Type	Description	Value(s)
`certificate`	string	A public certificate in PEM format accepted for image signature verification.