Skip to content

Commit 7271262

Browse files
author
Michael Burke
committed
OCP 13956 GA for sigstore API
1 parent 31e2350 commit 7271262

File tree

4 files changed

+7
-61
lines changed

4 files changed

+7
-61
lines changed

modules/nodes-sigstore-configure-cluster-policy.adoc

Lines changed: 2 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -15,31 +15,6 @@ The following example shows general guidelines on how to configure a `ClusterIma
1515
* You have a sigstore-supported public key infrastructure (PKI) or a link:https://docs.sigstore.dev/cosign/[Cosign public and private key pair] for signing operations.
1616
* You have a signing process in place to sign your images.
1717
* You have access to a registry that supports Cosign signatures, if you are using Cosign signatures.
18-
* You enabled the required Technology Preview features for your cluster by editing the `FeatureGate` CR named `cluster`:
19-
+
20-
[source,terminal]
21-
----
22-
$ oc edit featuregate cluster
23-
----
24-
+
25-
.Example `FeatureGate` CR
26-
[source,yaml]
27-
----
28-
apiVersion: config.openshift.io/v1
29-
kind: FeatureGate
30-
metadata:
31-
name: cluster
32-
spec:
33-
featureSet: TechPreviewNoUpgrade <1>
34-
----
35-
<1> Enables the required `SigstoreImageVerification` feature.
36-
+
37-
[WARNING]
38-
====
39-
Enabling the `TechPreviewNoUpgrade` feature set on your cluster cannot be undone and prevents minor version updates. This feature set allows you to enable these Technology Preview features on test clusters, where you can fully test them. Do not enable this feature set on production clusters.
40-
====
41-
+
42-
After you save the changes, new machine configs are created, the machine config pools are updated, and scheduling on each node is disabled while the change is being applied.
4318
4419
.Procedure
4520

@@ -49,7 +24,7 @@ After you save the changes, new machine configs are created, the machine config
4924
.Example cluster image policy object with a public key policy and the `MatchRepoDigestOrExact` match policy
5025
[source,yaml]
5126
----
52-
apiVersion: config.openshift.io/v1alpha1
27+
apiVersion: config.openshift.io/v1
5328
kind: ClusterImagePolicy <1>
5429
metadata:
5530
name: p1
@@ -83,7 +58,7 @@ spec:
8358
.Example cluster image policy object with a Fulcio certificate policy and the `remapIdentity` match policy
8459
[source,yaml]
8560
----
86-
apiVersion: config.openshift.io/v1alpha1
61+
apiVersion: config.openshift.io/v1
8762
kind: ClusterImagePolicy <1>
8863
metadata:
8964
name: p1

modules/nodes-sigstore-configure-image-policy.adoc

Lines changed: 2 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -30,32 +30,6 @@ $ oc image mirror quay.io/openshift-release-dev/ocp-release:sha256-1234567890abc
3030
mirror.com/image/repo:sha256-1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef.sig
3131
----
3232
33-
* You enabled the required Technology Preview features for your cluster by editing the `FeatureGate` CR named `cluster`:
34-
+
35-
[source,terminal]
36-
----
37-
$ oc edit featuregate cluster
38-
----
39-
+
40-
.Example `FeatureGate` CR
41-
[source,yaml]
42-
----
43-
apiVersion: config.openshift.io/v1
44-
kind: FeatureGate
45-
metadata:
46-
name: cluster
47-
spec:
48-
featureSet: TechPreviewNoUpgrade <1>
49-
----
50-
<1> Enables the required `SigstoreImageVerification` feature.
51-
+
52-
[WARNING]
53-
====
54-
Enabling the `TechPreviewNoUpgrade` feature set on your cluster cannot be undone and prevents minor version updates. This feature set allows you to enable these Technology Preview features on test clusters, where you can fully test them. Do not enable this feature set on production clusters.
55-
====
56-
+
57-
After you save the changes, new machine configs are created, the machine config pools are updated, and scheduling on each node is disabled while the change is being applied.
58-
5933
.Procedure
6034

6135
. Create an image policy object similar to the following examples. See "About cluster and image policy parameters" for specific details on these parameters.
@@ -64,7 +38,7 @@ After you save the changes, new machine configs are created, the machine config
6438
.Example image policy object with a public key policy and the `MatchRepository` match policy
6539
[source,yaml]
6640
----
67-
apiVersion: config.openshift.io/v1alpha1
41+
apiVersion: config.openshift.io/v1
6842
kind: ImagePolicy <1>
6943
metadata:
7044
name: p0
@@ -100,7 +74,7 @@ spec:
10074
.Example image policy object with a Fulcio certificate policy and the `ExactRepository` match policy
10175
[source,yaml]
10276
----
103-
apiVersion: config.openshift.io/v1alpha1
77+
apiVersion: config.openshift.io/v1
10478
kind: ImagePolicy <1>
10579
metadata:
10680
name: p1

modules/nodes-sigstore-configure.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ If the image or repository in an image policy is nested under one of the images
2222
.Example image policy with a conflicting image identity
2323
[source,yaml]
2424
----
25-
API Version: config.openshift.io/v1alpha1
25+
API Version: config.openshift.io/v1
2626
Kind: ImagePolicy
2727
Name: p0
2828
Namespace: mynamespace

nodes/nodes-sigstore-using.adoc

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ toc::[]
88

99
You can use link:https://www.sigstore.dev/[sigstore] with {product-title} to improve supply chain security.
1010

11-
:FeatureName: sigstore support
12-
include::snippets/technology-preview.adoc[]
13-
1411
// The following include statements pull in the module files that comprise
1512
// the assembly. Include any combination of concept, procedure, or reference
1613
// modules required to cover the user story. You can also include other
@@ -23,12 +20,12 @@ include::modules/nodes-sigstore-configure-cluster-policy.adoc[leveloffset=+1]
2320

2421
[role="_additional-resources"]
2522
.Additional resources
26-
xref:../nodes/nodes-sigstore-using.adoc#nodes-sigstore-configure-parameters_nodes-sigstore-using[About cluster and image policy parameters]
23+
* xref:../nodes/nodes-sigstore-using.adoc#nodes-sigstore-configure-parameters_nodes-sigstore-using[About cluster and image policy parameters]
2724
2825
include::modules/nodes-sigstore-configure-image-policy.adoc[leveloffset=+1]
2926

3027
[role="_additional-resources"]
3128
.Additional resources
3229

33-
xref:../nodes/nodes-sigstore-using.adoc#nodes-sigstore-configure-parameters_nodes-sigstore-using[About cluster and image policy parameters]
30+
* xref:../nodes/nodes-sigstore-using.adoc#nodes-sigstore-configure-parameters_nodes-sigstore-using[About cluster and image policy parameters]
3431

0 commit comments

Comments
 (0)