Skip to content

Add containerd image verification to k8s and expand ecs-3 verifiers #4832

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ginglis13 wants to merge 3 commits into
base: develop
Choose a base branch
from
Open

Add containerd image verification to k8s and expand ecs-3 verifiers #4832

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
adfb433
sources: add image verifier settings to k8s variants
ginglis13 May 8, 2026
08ca0e8
variants: add image verification packages to k8s and ecs-3
ginglis13 May 8, 2026
1c5ee7b
migrations: migrator for image-verifier-plugins on k8s
ginglis13 May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions sources/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions sources/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@ members = [
"settings-migrations/v1.56.0/image-verifier-plugins-extensible",
"settings-migrations/v1.60.0/kubernetes-topology-manager-policy-options",
"settings-migrations/v1.60.0/container-runtime-max-concurrent-unpacks",
"settings-migrations/v1.61.0/image-verifier-plugins-settings",

"settings-plugins/aws-dev",
"settings-plugins/aws-ecs-2",
Expand Down
1 change: 1 addition & 0 deletions sources/settings-defaults/aws-k8s-1.33-nvidia/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
1 change: 1 addition & 0 deletions sources/settings-defaults/aws-k8s-1.33/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
1 change: 1 addition & 0 deletions sources/settings-defaults/aws-k8s-1.34-nvidia/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
1 change: 1 addition & 0 deletions sources/settings-defaults/aws-k8s-1.34/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
1 change: 1 addition & 0 deletions sources/settings-defaults/aws-k8s-1.35-nvidia/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
1 change: 1 addition & 0 deletions sources/settings-defaults/aws-k8s-1.35/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
1 change: 1 addition & 0 deletions sources/settings-defaults/vmware-k8s-1.33/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
1 change: 1 addition & 0 deletions sources/settings-defaults/vmware-k8s-1.34/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
1 change: 1 addition & 0 deletions sources/settings-defaults/vmware-k8s-1.35/defaults.d/58-image-verification.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
../../../shared-defaults/image-verification.toml
10 changes: 10 additions & 0 deletions sources/settings-migrations/v1.61.0/image-verifier-plugins-settings/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
[package]
name = "image-verifier-plugins-settings"
version = "0.1.0"
license = "Apache-2.0 OR MIT"
edition = "2021"
publish = false
exclude = ["README.md"]

[dependencies]
migration-helpers.workspace = true
58 changes: 58 additions & 0 deletions sources/settings-migrations/v1.61.0/image-verifier-plugins-settings/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
use migration_helpers::common_migrations::{AddPrefixesMigration, NoOpMigration};
use migration_helpers::{migrate, MigrationData, Result};
use std::process;

/// Added new image-verifier-plugins settings.
/// For k8s variants: remove the settings on downgrade since they didn't exist before.
/// For ecs-3 variants: no migration needed since these settings already exist.
fn run() -> Result<()> {
// Create a custom migration that checks variant at runtime
migrate(VariantSpecificMigration)
}

struct VariantSpecificMigration;

impl migration_helpers::Migration for VariantSpecificMigration {
fn forward(&mut self, input: MigrationData) -> Result<MigrationData> {
// No work needed on upgrade for any variant
println!("VariantSpecificMigration has no work to do on upgrade.");
Ok(input)
}

fn backward(&mut self, input: MigrationData) -> Result<MigrationData> {
// Check variant from runtime data
if let Some(variant_value) = input.data.get("os.variant_id") {
if let Some(variant_str) = variant_value.as_str() {
if variant_str.starts_with("aws-k8s-") || variant_str.starts_with("vmware-k8s-") {
// For k8s variants, remove the settings on downgrade
println!("k8s variant detected ({}), removing image-verifier-plugins settings on downgrade", variant_str);
return AddPrefixesMigration(vec!["settings.image-verifier-plugins"])
.backward(input);
} else if variant_str.starts_with("aws-ecs-") {
// For ECS variants, no migration needed
println!(
"ECS variant detected ({}), no migration needed",
variant_str
);
return NoOpMigration.backward(input);
}
}
}

// Default behavior for unknown variants
println!(
"Unknown or missing variant, using default behavior (remove settings on downgrade)"
);
AddPrefixesMigration(vec!["settings.image-verifier-plugins"]).backward(input)
}
}

// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
// https://github.com/shepmaster/snafu/issues/110
fn main() {
if let Err(e) = run() {
eprintln!("{e}");
process::exit(1);
}
}
1 change: 1 addition & 0 deletions sources/settings-plugins/aws-k8s/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,5 +24,6 @@ struct AwsK8sSettings {
dns: bottlerocket_settings_models::DnsSettingsV1,
container_runtime: bottlerocket_settings_models::ContainerRuntimeSettingsV1,
container_runtime_plugins: bottlerocket_settings_models::ContainerRuntimePluginsSettingsV1,
image_verifier_plugins: bottlerocket_settings_models::ImageVerifierPluginsSettingsV1,
autoscaling: bottlerocket_settings_models::AutoScalingSettingsV1,
}
1 change: 1 addition & 0 deletions sources/settings-plugins/vmware-k8s/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,4 +23,5 @@ struct VmwareK8sSettings {
dns: bottlerocket_settings_models::DnsSettingsV1,
container_runtime: bottlerocket_settings_models::ContainerRuntimeSettingsV1,
container_runtime_plugins: bottlerocket_settings_models::ContainerRuntimePluginsSettingsV1,
image_verifier_plugins: bottlerocket_settings_models::ImageVerifierPluginsSettingsV1,
}
2 changes: 2 additions & 0 deletions variants/aws-ecs-3-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,9 @@ included-packages = [
# ecs
"ecs-agent-config",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
]
kernel-parameters = [
"console=tty0",
Expand Down
2 changes: 2 additions & 0 deletions variants/aws-ecs-3-nvidia-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,9 @@ included-packages = [
# ecs
"ecs-agent-nvidia-config",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# NVIDIA support
"ecs-gpu-init",
"nvidia-container-toolkit-ecs",
Expand Down
2 changes: 2 additions & 0 deletions variants/aws-ecs-3-nvidia/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,9 @@ included-packages = [
# ecs
"ecs-agent-nvidia-config",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# NVIDIA support
"ecs-gpu-init",
"nvidia-container-toolkit-ecs",
Expand Down
2 changes: 2 additions & 0 deletions variants/aws-ecs-3/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,9 @@ included-packages = [
# ecs
"ecs-agent-config",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
]
kernel-parameters = [
"console=tty0",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.33-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,10 @@ included-packages = [
"kubelet-1.33",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
]
kernel-parameters = [
"console=tty0",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.33-nvidia-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,10 @@ included-packages = [
"kubelet-1.33",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# nvidia
"nvidia-container-toolkit-k8s",
"nvidia-k8s-device-plugin",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.33-nvidia/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ included-packages = [
"kubelet-1.33",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# nvidia
"nvidia-container-toolkit-k8s",
"nvidia-k8s-device-plugin",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.33/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,10 @@ included-packages = [
"kubelet-1.33",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
]
kernel-parameters = [
"console=tty0",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.34-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ included-packages = [
"kubelet-1.34",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
]
kernel-parameters = [
"console=tty0",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.34-nvidia-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,10 @@ included-packages = [
"kubelet-1.34",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# nvidia
"nvidia-container-toolkit-k8s",
"nvidia-k8s-device-plugin",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.34-nvidia/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,10 @@ included-packages = [
"kubelet-1.34",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# nvidia
"nvidia-container-toolkit-k8s",
"nvidia-k8s-device-plugin",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.34/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@ included-packages = [
"kubelet-1.34",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
]
kernel-parameters = [
"console=tty0",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.35-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ included-packages = [
"kubelet-1.35",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
]
kernel-parameters = [
"console=tty0",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.35-nvidia-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,10 @@ included-packages = [
"kubelet-1.35",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# nvidia
"nvidia-container-toolkit-k8s",
"nvidia-k8s-device-plugin",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.35-nvidia/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,10 @@ included-packages = [
"kubelet-1.35",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# nvidia
"nvidia-container-toolkit-k8s",
"nvidia-k8s-device-plugin",
Expand Down
4 changes: 4 additions & 0 deletions variants/aws-k8s-1.35/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,10 @@ included-packages = [
"kubelet-1.35",
"aws-iam-authenticator",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
]
kernel-parameters = [
"console=tty0",
Expand Down
4 changes: 4 additions & 0 deletions variants/vmware-k8s-1.33-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ included-packages = [
"cni-plugins",
"kubelet-1.33",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# vmware
"open-vm-tools",
]
Expand Down
4 changes: 4 additions & 0 deletions variants/vmware-k8s-1.33/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,10 @@ included-packages = [
"cni-plugins",
"kubelet-1.33",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# vmware
"open-vm-tools",
]
Expand Down
4 changes: 4 additions & 0 deletions variants/vmware-k8s-1.34-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,10 @@ included-packages = [
"cni-plugins",
"kubelet-1.34",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# vmware
"open-vm-tools",
]
Expand Down
4 changes: 4 additions & 0 deletions variants/vmware-k8s-1.34/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,10 @@ included-packages = [
"cni-plugins",
"kubelet-1.34",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# vmware
"open-vm-tools",
]
Expand Down
4 changes: 4 additions & 0 deletions variants/vmware-k8s-1.35-fips/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,10 @@ included-packages = [
"cni-plugins",
"kubelet-1.35",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# vmware
"open-vm-tools",
]
Expand Down
4 changes: 4 additions & 0 deletions variants/vmware-k8s-1.35/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,10 @@ included-packages = [
"cni-plugins",
"kubelet-1.35",
"soci-snapshotter",
"aws-signer-notation-plugin",
"digestion-image-verifier",
"notation-image-verifier",
"thar-be-image-verifiers",
# vmware
"open-vm-tools",
]
Expand Down
Loading