Add signature checking for container images during auto-updates
aimichelle opened this issue · comments
Is your feature request related to a problem? Please describe.
Pixie has an auto-update system. By default, self-hosted cloud deployments do not auto-update as releases are made. However, if users were to update the available release versions, vzmgr will attempt to update any older Viziers to the latest version. Vizier will fetch the YAMLs for the release and deploy them to the cluster. We currently assume that the manifests/YAMLs are correct (hosted on Github). However, it would be even more robust to also validate the signatures on the container images in the YAMLs.
Describe the solution you'd like
We recently added cosign to sign our container images for the control plane/data plane. Before we apply the release YAMLs to the cluster when auto-updating, we can check the signatures on each of the container images to verify they are trusted.
Describe alternatives you've considered
An update/release system such as TUF.