🐛 [bug] - Image signing/Jenkins fails with unknown cert signer issue
Closed this issue · 11 comments
📝 Description
Image signing/Jenkins fails with unknown cert signer issue
🚶 Steps to reproduce
https://rht-labs.com/tech-exercise/#/3-revenge-of-the-automated-testing/8a-jenkins
, the Jenkins pipeline fails oc registry login cosign sign -key k8s://${TEAM_NAME}-ci-cd/${TEAM_NAME}-cosignoc registry info/${DESTINATION_NAMESPACE}/${APP_NAME}:${VERSION} :
sh: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
+ oc registry login
info: Using internal registry hostname image-registry.openshift-image-registry.svc:5000
Saved credentials for image-registry.openshift-image-registry.svc:5000
++ oc registry info
+ cosign sign -key k8s://fulanitos-ci-cd/fulanitos-cosign image-registry.openshift-image-registry.svc:5000/fulanitos-test/pet-battle:1.3.1
error: signing image-registry.openshift-image-registry.svc:5000/fulanitos-test/pet-battle:1.3.1: getting remote image: Get "https://image-registry.openshift-image-registry.svc:5000/v2/": x509: certificate signed by unknown authority
script returned exit code 1
The Tekton process looks pretty similar, so skipping that one for speed.
Looks like the registry was not exposed in this cluster deployment.
oc patch config.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
and the external login needed adjustment. PTAL and try agin @alexpdp7
OK, the Jenkins step fails with:
$ cosign verify -key cosign.pub default-route-openshift-image-registry.apps.tl500-1.ls-eu.ole.redhat.com/fulanitos-test/pet-battle:1.3.1
error: no matching signatures:
failed to verify signature
even though I think the image is signed:
and my key is there:
$ cat cosign.pub
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOZRDial+hwif1Ch4AVJgVrzx1oeD
HqObdnYieO/PMWue5SUz97Tn67AB8VganEKlc1BNL9US+7RSo7omO/lchA==
-----END PUBLIC KEY-----
Checking the Tekton version now.
Ahh good catch Alex, we need to update the verify step. It should work when you run the following command. Can you please verify it?
cosign verify --key k8s://${TEAM_NAME}-ci-cd/${TEAM_NAME}-cosign default-route-openshift-image-registry.apps.tl500-1.ls-eu.ole.redhat.com/fulanitos-test/pet-battle:1.3.1
Looks like the registry was not exposed in this cluster deployment.
oc patch config.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=mergeand the external login needed adjustment. PTAL and try agin @alexpdp7
@jfilipcz @eformat should we include this to Lodestar deployment or add to enablement-framework?
merged :)
Cool, closing this for now .. LGTM