Container Image Policy about enhancements

[idvoretskyi]

cc @kubernetes/sig-auth

[erictune]

@soltysh you were interested in this issue too.

[soltysh]

@erictune thx

[philips]

Status update: design proposal is merged: kubernetes/kubernetes#27129

[philips]

Also, @ecordell intends to work on the code for this feature now that the code has been merged. @Q-Lee @erictune @alex-mohr

[philips]

Updated the PRs for the current implementation kubernetes/kubernetes#30631 and API changes kubernetes/kubernetes#30241. Looks likely to land for v1.4. @Q-Lee and @ecordell how are y'all feeling?

[Q-Lee]

@philips It's looking good.

@philips The API is being tested in the merge queue atm, and the implementation is close to an lgtm. I'm setting up a test for gce/gci on top of ecordell's changes atm.

[ecordell]

@philips API is in! I'm hopeful the implementation will go through today

[ecordell]

kubernetes/kubernetes#30631 is merged

[janetkuo]

@philips Are the docs ready? Please update the docs in https://github.com/kubernetes/kubernetes.github.io, and then add PR numbers and check the docs box in the issue description

[jaredbhatti]

Ping. Any update on docs?

[Q-Lee]

@philips @ecordell What are the plans for the docs with this?

[ecordell]

@Q-Lee I'll work on them and have a PR soon

[ecordell]

Docs PR: kubernetes/website#1188

[ecordell]

For making image policy decisions, it's important that the backend be able to resolve tags to digests so that downstream services see a consistent view of approved images.

I've started sketching the changes here (no tests or codegen):

kubernetes/kubernetes@master...ecordell:imagereviewwebhook-digest

There is some overlap between this and kubernetes/community#132, but mutation is not in the scope of that proposal (simply planned for later).

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[erictune]

I recommend further features requests for image policy first be attempted using validating webhooks.

[saschagrunert]

Hey folks, what is the future plan for this feature? I see that it may fit into a native sigstore container image validation support for Kubernetes.