Before deploying registry.example.test/payments@sha256:abc123, scan it for critical findings and verify its signing identity.
Simulateur déterministe — tape une commande (kubectl get pods -A) pour commencer.
student@kubelab:~$
Objectifs
- Use an immutable digest reference
- Run a HIGH/CRITICAL Trivy scan
- Run cosign verify with issuer and identity constraints
- Deploy only after checks
Étapes suggérées
- The simulator records the command workflow rather than contacting a registry.
- Include both certificate identity and OIDC issuer in verification.
- Do not substitute a tag for the digest.
Indices
Voir la solution
trivy image --severity HIGH,CRITICAL registry.example.test/payments@sha256:abc123 cosign verify registry.example.test/payments@sha256:abc123 --certificate-identity=builder@example.test --certificate-oidc-issuer=https://token.actions.githubusercontent.com kubectl create deployment payments-signed -n secure --image=registry.example.test/payments@sha256:abc123