OC-ADM-VERIFY-IMAGE-SIGNATURE(1)

📦
version 4.22.0 · 2 versions
, in nixpkgs unstable

💖 oc adm verify-image-signature 💖

okay bestie, welcome to the OC ADM(1) manual page for oc adm verify-image-signature — June 2016 edition, and we are verifying image identity/signatures with main character energy. let's go 💅

🏷️ NAME 🏷️

oc adm verify-image-signature — verify the image identity contained in the image signature. that's the name, that's the job, iconic ✨

🧾 SYNOPSIS 🧾

oc adm verify-image-signature [OPTIONS]

[OPTIONS] means you bring the flags, bestie 🫶

🔍 DESCRIPTION 🔍

This command verifies the image signature of an image imported to internal registry using the local public GPG key. lowkey powerful 💜

So basically it checks whether the image identity contained in the image signature can be trusted. How? It uses the public GPG key to verify the signature itself, and it matches the expected identity you provide against the identity (pull spec) of the given image. By default, this command uses the public GPG keyring located in "$GNUPGHOME/.gnupg/pubring.gpg" 🎀

By default, this command will not save the result of the verification back to the image object; to do so the user must specify the "--save" flag. Note that to modify the image signature verification status, the user must have permissions to edit an image object (usually an "image-auditor" role). permissions check, always 💅

⚠️ careful, bestie: using the "--save" flag on an already verified image together with an invalid GPG key or invalid expected identity will cause the saved verification status to be removed and the image will become "unverified". that's the danger zone 😭

If this command is outside the cluster, users must specify the "--registry-url" parameter with the public URL of image registry. no cap, you need the URL 🌈

To remove all verifications, users can use the "--remove-all" flag. clean slate energy 🧚

💅 OPTIONS 💅

  • --expected-identity="" — an expected image docker reference to verify (required). required, bestie, do not skip it 👑
  • --insecure=false — if set, use the insecure protocol for registry communication. default is false 🔥
  • --public-key="pubring.gpg" — a path to a public GPG key to be used for verification. defaults to "pubring.gpg" 🎀
  • --registry-url="" — the address to use when contacting the registry, instead of using the internal cluster address. this is useful if you can't resolve or reach the internal registry address. very outside-the-cluster of you 🌸
  • --remove-all=false — if set, all signature verifications will be removed from the given image. default is false 🦋
  • --save=false — if true, the result of the verification will be saved to an image object. default is false ⭐

🧬 OPTIONS INHERITED FROM PARENT COMMANDS 🧬

these come from the parent commands, no cap:

  • --as="" — username to impersonate for the operation. user could be a regular user or a service account in a namespace. 🫶
  • --as-group=[] — group to impersonate for the operation; this flag can be repeated to specify multiple groups. 🎀
  • --as-uid="" — UID to impersonate for the operation. 💜
  • --as-user-extra=[] — user extras to impersonate for the operation; this flag can be repeated to specify multiple values for the same key. 🌸
  • --cache-dir="/homeless-shelter/.kube/cache" — default cache directory. keep it exact, bestie 💅
  • --certificate-authority="" — path to a cert file for the certificate authority. 🔥
  • --client-certificate="" — path to a client certificate file for TLS. 🦋
  • --client-key="" — path to a client key file for TLS. 🔑
  • --cluster="" — the name of the kubeconfig cluster to use. 🌈
  • --context="" — the name of the kubeconfig context to use. 🧚
  • --disable-compression=false — if true, opt-out of response compression for all requests to the server. default is false ⭐
  • --insecure-skip-tls-verify=false — if true, the server's certificate will not be checked for validity. this will make your HTTPS connections insecure ⚠️ default is false
  • --kubeconfig="" — path to the kubeconfig file to use for CLI requests. 🎀
  • --kuberc="" — path to the kuberc file to use for preferences. this can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off. 👑
  • --match-server-version=false — require server version to match client version. default is false 🫶
  • -n, --namespace="" — if present, the namespace scope for this CLI request. 💜
  • --profile="none" — name of profile to capture. one of (none|cpu|heap|goroutine|threadcreate|block|mutex). default is "none" 🔥
  • --profile-output="profile.pprof" — name of the file to write the profile to. default is "profile.pprof" 🌸
  • --request-timeout="0" — the length of time to wait before giving up on a single server request. non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). a value of zero means don't timeout requests. default is "0" ⭐
  • -s, --server="" — the address and port of the Kubernetes API server. 🌈
  • --tls-server-name="" — server name to use for server certificate validation. if it is not provided, the hostname used to contact the server is used. 🧚
  • --token="" — bearer token for authentication to the API server. 🔑
  • --user="" — the name of the kubeconfig user to use. 💅
  • --warnings-as-errors=false — treat warnings received from the server as errors and exit with a non-zero exit code. default is false 😭

📸 EXAMPLE 📸

okay these examples are exact, bestie — copy them character for character:

                # Verify the image signature and identity using the local GPG keychain
                oc adm verify-image-signature sha256:c841e9b64e4579bd56c794bdd7c36e1c257110fd2404bebbb8b613e4935228c4 \
                --expected-identity=registry.local:5000/foo/bar:v1

                # Verify the image signature and identity using the local GPG keychain and save the status
                oc adm verify-image-signature sha256:c841e9b64e4579bd56c794bdd7c36e1c257110fd2404bebbb8b613e4935228c4 \
                --expected-identity=registry.local:5000/foo/bar:v1 --save

                # Verify the image signature and identity via exposed registry route
                oc adm verify-image-signature sha256:c841e9b64e4579bd56c794bdd7c36e1c257110fd2404bebbb8b613e4935228c4 \
                --expected-identity=registry.local:5000/foo/bar:v1 \
                --registry-url=docker-registry.foo.com

                # Remove all signature verifications from the image
                oc adm verify-image-signature sha256:c841e9b64e4579bd56c794bdd7c36e1c257110fd2404bebbb8b613e4935228c4 --remove-all

👀 SEE ALSO 👀

oc-adm(1), — go see the parent page, bestie, iykyk 🫶

🕰️ HISTORY 🕰️

June 2016, Ported from the Kubernetes man-doc generator — vintage, but make it fresh ✨

okay that's the whole page! cute sign-off time: the footer says source/version Openshift, manual collection Openshift CLI User Manuals, and date June 2016. mwah 💖🎀🦋

📦 where this page comes from