Epic Goal

• Enhance the signed containers images feature delivered in OSC 1.8.0
• Leverage the upstream implementation of the feature

Why is this important?

• On OSC 1.8.0 it was delivered a downstream-only implementation of signed containers because the feature wasn't fully done upstream and it was important for our relation with Microsoft to deliver it. While the feature works, it brought usability issues. For instance, user is mandatory to create the containers policy in KBS otherwise any pod will break to start. This made the OSC CoCo heavily dependent on KBS and prone to errors.

Scenarios

1. ....

Acceptance Criteria 

The Epic is complete when:

1. Signed container images is fully implemented upstream at cloud-api-adaptor
2. The upstream feature is consumed on an OSC release
3. OSC user guide is updated

Additional context:

The issue upstream: https://github.com/confidential-containers/cloud-api-adaptor/issues/1989