Epic Goal

• This epic focuses on allowing workloads to be deployed using signed container images with

Why is this important?

• It will allow customers in ARO trying the workflow of signing container images, running and verifying it

Scenarios

1. Example: Cluster administrator able to configure peer-pods functionality using the OSC operator
2. ...
3. ...

Acceptance Criteria 

(The Epic is complete when...)

1. Downstream configuration changes are in pod vm image.
   New dev work in the OSC confidential containers podvm image. Set two hardcoded values in the agent-config.toml:
   enable_signature_verification=true - this enables signature verification
   image_policy_file=<uri> - this points to the URI of the policy file. I'd suggest picking a value like `kbs:///default/security-policy/osc` or similar
2. Creating a pod from an unsigned image, on an insecureAcceptAnything registry works.
   e.g. use a standard container image for testing e.g. quay.io/prometheus/busybox:latest
   Set a permissive policy to trustee with resource path `default/security-policy/osc`:
   ```
   "default": [ { "type": "insecureAcceptAnything" }

   ]
   ```
   Create the pod and it should start fine

3. Create a pod from a signed image, on a 'restricted registry' is successful.
   Create a signed image to a test registry
   Upload the public key to trustee with resource path `default/cosign-public-key/test`
   Create a policy and upload to `default/security-policy/osc`:
   ```
   "<test registry>": [ { "type": "sigstoreSigned", "keyPath": "kbs:///default/cosign-public-key/test" }

   ]
   ```
   Create a pod from the image and check it works

4. Create a pod from an unsigned image, on a 'restricted registry' is rejected.
   Create an unsigned image in a test registry
   Upload the (any public key? or resource the one from the previous test) to trustee with resource path `default/cosign-public-key/test`
   Create a policy and upload to `default/security-policy/osc`:
   ```
   "<test registry>": [ { "type": "sigstoreSigned", "keyPath": "kbs:///default/cosign-public-key/test" }

   ]
   ```
   Create a pod from the image and check it fails

5. Create a pod from a signed image, on a 'restricted registry', but with the wrong key is rejected
   Create a signed image to a test registry
   Upload a different public key to trustee with resource path `default/cosign-public-key/test`
   Create a policy and upload to `default/security-policy/osc`:
   ```
   "<test registry>": [ { "type": "sigstoreSigned", "keyPath": "kbs:///default/cosign-public-key/test" }

   ]
   ```
   Create a pod from the image and check it fails

Additional context:

• Document how to sign a container image. I think https://docs.sigstore.dev/cosign/signing/signing_with_containers/ has the best information
• Document how to set the public Key used in the signing to Trustee (e.g. to `kbs:///default/cosign-public-key/osc`)
• Document how to write the policy.json for the customer's use case and how to set it as a resource to `default/security-policy/osc` (or wherever) on trustee