{{< highlight yaml >}} apiVersion: v1alpha1 kind: ImageVerificationConfig

List of verification rules.

rules: - image: registry.k8s.io/* # Image reference pattern to match for this rule. # Keyless verifier configuration to use for this rule. keyless: issuer: https://accounts.google.com # OIDC issuer URL for keyless verification. subject: [email protected] # Expected subject for keyless verification.

    # # Regex pattern for subject matching.
    # subjectRegex: .*@example\.com
- image: my-registry.example.com/* # Image reference pattern to match for this rule.
  # Public key verifier configuration to use for this rule.
  publicKey:
    certificate: |- # A public certificate in PEM format accepted for image signature verification.
        -----BEGIN CERTIFICATE-----
        MII--Sample Value--
        -----END CERTIFICATE-----
- image: localhost:3000/* # Image reference pattern to match for this rule.
  deny: true # Deny pulling images matching the pattern (default: false).

{{< /highlight >}}

rules[] {#ImageVerificationConfig.rules.}

ImageVerificationRuleV1Alpha1 defines a verification rule.

The pattern is matched against the normalized image reference, which always starts with a registry domain: docker.io/library/nginx* matches nginx:latest, while library/nginx* matches nothing. The Docker Hub domain is always normalized to docker.io, so a pattern written against index.docker.io or registry-1.docker.io matches the same images a docker.io one does. <details><summary>Show example(s)</summary>{{< highlight yaml >}} image: docker.io/library/nginx {{< /highlight >}}{{< highlight yaml >}} image: registry.k8s.io/* {{< /highlight >}}</details> | | |skip |bool |Skip verification for this image pattern (default: false). | | |deny |bool |Deny pulling images matching the pattern (default: false). | | |keyless |<a href="#ImageVerificationConfig.rules..keyless">ImageKeylessVerifierV1Alpha1</a> |Keyless verifier configuration to use for this rule. | | |publicKey |<a href="#ImageVerificationConfig.rules..publicKey">ImagePublicKeyVerifierV1Alpha1</a> |Public key verifier configuration to use for this rule. | |

keyless {#ImageVerificationConfig.rules..keyless}

ImageKeylessVerifierV1Alpha1 configures a signature verification provider using Cosign keyless verification.

This is the identity (email, URI) that signed the image. | | |subjectRegex |string |Regex pattern for subject matching.

Use this instead of subject for flexible matching. <details><summary>Show example(s)</summary>{{< highlight yaml >}} subjectRegex: .*@example.com {{< /highlight >}}</details> | |

publicKey {#ImageVerificationConfig.rules..publicKey}

ImagePublicKeyVerifierV1Alpha1 configures a signature verification provider using a static public key.