vsatctl img-verify¶
vsatctl img-verify [true|false] [flags]
Enable or disable container image signature verification.
Run the command without an argument to show the current state. Pass true or false to change it.
Note
You must run this command with root privileges because it connects to the VSatellite cluster using credentials from a file that only root users can access.
Examples¶
Show whether enforcement is currently on or off:
sudo vsatctl img-verify
When enforcement is on, the command returns:
INFO Image verification is currently enabled (enforcing)
When enforcement is off, the command returns:
INFO Image verification is currently disabled (detection mode)
Turn enforcement on, so that unsigned or invalid images are rejected:
sudo vsatctl img-verify true
Turn enforcement off and run in detection mode, where nothing is blocked:
sudo vsatctl img-verify false
Arguments¶
| Argument | Description |
|---|---|
| None | Show the current state. |
true | Enforce verification. Unsigned or invalid images are rejected and their pods are denied. |
false | Run in detection mode. Verification still runs and is logged, but no pods are blocked. |
Changing the setting restarts the Connaisseur admission controller so that the new behavior takes effect immediately. The setting persists across VSatellite updates.
Important
Turn enforcement off only as a temporary workaround, and only when advised to. Detection mode leaves the VSatellite without the protection that image signature verification provides.
Options¶
-h, --help help for img-verify