{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30603","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30603/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30603/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30603/events","html_url":"https://github.com/kubernetes/kubernetes/issues/30603","id":171098465,"number":30603,"title":"Image Signing Support","user":{"login":"zhouhaibing089","id":4516999,"avatar_url":"https://avatars.githubusercontent.com/u/4516999?v=3","gravatar_id":"","url":"https://api.github.com/users/zhouhaibing089","html_url":"https://github.com/zhouhaibing089","followers_url":"https://api.github.com/users/zhouhaibing089/followers","following_url":"https://api.github.com/users/zhouhaibing089/following{/other_user}","gists_url":"https://api.github.com/users/zhouhaibing089/gists{/gist_id}","starred_url":"https://api.github.com/users/zhouhaibing089/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhouhaibing089/subscriptions","organizations_url":"https://api.github.com/users/zhouhaibing089/orgs","repos_url":"https://api.github.com/users/zhouhaibing089/repos","events_url":"https://api.github.com/users/zhouhaibing089/events{/privacy}","received_events_url":"https://api.github.com/users/zhouhaibing089/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubectl","name":"component/kubectl","color":"0052cc"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/node","name":"team/node","color":"d2b48c"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-15T02:37:32Z","updated_at":"2016-08-17T07:44:45Z","closed_at":"2016-08-17T07:44:45Z","body":"these days, there is a proposal https://github.com/kubernetes/kubernetes/pull/27129 states we should be able to do an image review, for example, to ensure that the image does not have any vulnerabilities, we may set up an Clair instance, and enabling an admission controller to query its api to verify this image is safe to run.\r\n\r\nHowever there is one thing more to consider as well, there is a concept which is named [Docker Content Trust](https://blog.docker.com/2015/08/content-trust-docker-1-8/), it is used to ensure we always get the correct image, the *correct* means we are pulling images from the right source, and it is exactly pushed by some people(including CI).\r\n\r\nI did not get the answer clearly on how will this be involved in, for example, the `DockerInterface` may introduce another method, something like `VerifyImage`, or it could be part of `PullImage`.\r\n\r\ncc @erictune @liggitt "},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/240338013","html_url":"https://github.com/kubernetes/kubernetes/issues/30603#issuecomment-240338013","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/30603","id":240338013,"user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"created_at":"2016-08-17T07:44:45Z","updated_at":"2016-08-17T07:44:45Z","body":"Cool demonstration that DCT is working, @nhlfr !\r\n\r\nClosing since I think that answers the original question."}}
{"actor":{"display_login":"erictune"}}