I am trying to validate signatures of images deployed to kubernetes cluster with connaisseur.

Here is the configuration of validators:

application:
  validators:
    - name: allow
      type: static
      approve: true
    - name: deny
      type: static
      approve: false
    - name: ecr
      type: cosign
      trustRoots:
      - name: signpath
        key: |
          -----BEGIN PUBLIC KEY-----
          *********************************
          -----END PUBLIC KEY-----
      auth:
        secret_name: my-secret

  policy:
    - pattern: "*:*"
      validator: deny
    - pattern: "*ecr*"
      validator: ecr
      with:
        trustRoot: "signpath"
    - pattern: "registry.k8s.io/*:*"
      validator: allow

The crucial part here is

auth:
  secret_name: my-secret

Without those lines, the connaisseur deploys properly, however, it does not verify the images, it is complaining that there are no signature digests. That led me to conclude ECR connection is not properly configured.

I configured my-secret with as specified here (https://sse-secure-systems.github.io/connaisseur/v2.6.0/validators/sigstore_cosign/#dockerconfigjson:~:text=to%20do%20this.-,dockerconfigjson,-%E2%9A%93%EF%B8%8E):

kubectl create secret generic my-secret 
  --from-file=.dockerconfigjson=.docker/config.json 
  --type=kubernetes.io/dockerconfigjson 
  -n connaisseur

The docker is properly configured and I am able to pull images from private ECR.

I deploy with this:

helm upgrade --install connaisseur --atomic --namespace connaisseur -f connaisseur/helm/values.yaml ./connaisseur/helm --debug

Here is the error output:

history.go:56: [debug] getting history for release connaisseur
Release "connaisseur" does not exist. Installing it now.
install.go:222: [debug] Original chart version: ""
install.go:239: [debug] CHART PATH: /home/xdavid/connaisseur/helm

client.go:142: [debug] creating 15 resource(s)
wait.go:50: [debug] beginning wait for 15 resources with timeout of 5m0s
ready.go:297: [debug] Deployment is not ready: connaisseur/connaisseur. observedGeneration (0) does not match spec generation (1).
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
ready.go:303: [debug] Deployment is not ready: connaisseur/connaisseur. 0 out of 3 expected pods are ready
wait.go:87: [debug] Error received when checking status of resource connaisseur-redis-service. Error: 'client rate limiter Wait returned an error: context deadline exceeded', Resource details: 'Resource: "/v1, Resource=services", GroupVersionKind: "/v1, Kind=Service"
Name: "connaisseur-redis-service", Namespace: "connaisseur"'
wait.go:94: [debug] Retryable error? true
wait.go:71: [debug] Retrying as current number of retries 0 less than max number of retries 30
install.go:496: [debug] Install failed and atomic is set, uninstalling release
uninstall.go:102: [debug] uninstall: Deleting connaisseur
uninstall.go:248: [debug] uninstall: given cascade value: , defaulting to delete propagation background
client.go:486: [debug] Starting delete for "connaisseur-svc" Service
client.go:486: [debug] Starting delete for "connaisseur-redis-service" Service
client.go:486: [debug] Starting delete for "connaisseur-redis" Deployment
client.go:486: [debug] Starting delete for "connaisseur" Deployment
client.go:486: [debug] Starting delete for "connaisseur-role-binding" RoleBinding
client.go:486: [debug] Starting delete for "connaisseur-role" Role
client.go:486: [debug] Starting delete for "connaisseur-cluster-role-binding" ClusterRoleBinding
client.go:486: [debug] Starting delete for "connaisseur-cluster-role" ClusterRole
client.go:486: [debug] Starting delete for "connaisseur-env" ConfigMap
client.go:486: [debug] Starting delete for "connaisseur-alert-config" ConfigMap
client.go:486: [debug] Starting delete for "connaisseur-app-config" ConfigMap
client.go:486: [debug] Starting delete for "connaisseur-tls" Secret
client.go:486: [debug] Starting delete for "connaisseur-redis-secret" Secret
client.go:486: [debug] Starting delete for "connaisseur-redis-tls" Secret
client.go:486: [debug] Starting delete for "connaisseur-serviceaccount" ServiceAccount
client.go:486: [debug] Starting delete for "connaisseur-webhook" MutatingWebhookConfiguration
client.go:490: [debug] Ignoring delete failure for "connaisseur-webhook" admissionregistration.k8s.io/v1, Kind=MutatingWebhookConfiguration: mutatingwebhookconfigurations.admissionregistration.k8s.io "connaisseur-webhook" not found
wait.go:104: [debug] beginning wait for 1 resources to be deleted with timeout of 5m0s
client.go:142: [debug] creating 1 resource(s)
client.go:486: [debug] Starting delete for "connaisseur-webhook" MutatingWebhookConfiguration
wait.go:104: [debug] beginning wait for 1 resources to be deleted with timeout of 5m0s
uninstall.go:155: [debug] purge requested for connaisseur
Error: release connaisseur failed, and has been uninstalled due to atomic being set: context deadline exceeded
helm.go:84: [debug] context deadline exceeded
release connaisseur failed, and has been uninstalled due to atomic being set
helm.sh/helm/v3/pkg/action.(*Install).failRelease
        helm.sh/helm/v3/pkg/action/install.go:504
helm.sh/helm/v3/pkg/action.(*Install).RunWithContext
        helm.sh/helm/v3/pkg/action/install.go:402
main.runInstall
        helm.sh/helm/v3/cmd/helm/install.go:314
main.newUpgradeCmd.func2
        helm.sh/helm/v3/cmd/helm/upgrade.go:157
github.com/spf13/cobra.(*Command).execute
        github.com/spf13/[email protected]/command.go:983
github.com/spf13/cobra.(*Command).ExecuteC
        github.com/spf13/[email protected]/command.go:1115
github.com/spf13/cobra.(*Command).Execute
        github.com/spf13/[email protected]/command.go:1039
main.main
        helm.sh/helm/v3/cmd/helm/helm.go:83
runtime.main
        runtime/proc.go:271
runtime.goexit
        runtime/asm_amd64.s:1695

I also tried this but it did not help:

kubectl create secret docker-registry my-secret 
  --docker-server=<id>.dkr.ecr.us-east-1.amazonaws.com 
  --docker-username=AWS 
  --docker-password=$(aws ecr get-login-password) 
  --namespace=connaisseur