Description

I am trying the cosigned pod (pod image signature verification).

I tried various policies, like

],
  "transports": {}
}

which should forbid any pod, but I can still manage to run any pod, wether it's unsigned or not.

Steps to reproduce

1. Install trustee (https, insecure_admin=false, insecure_key=false)
2. Set up security policy as above
3. Install CoCo and try to run any unsigned pod

Expected result

Pod should not run

Actual result

Pod actually runs and it's able to do attestation

Impact

Signed policy feature seems to not enforce a thing

Env

OSC 1.10.2, default kata components, everything default. Trustee 0.4.1