V-260942

Discussion

Controlling the sources where container images can be pulled from allows the organization to define what software can be run within MKE. Allowing any container image to be introduced and instantiated within MKE may introduce malicious code and vulnerabilities to the platform and the hosting system. MKE registry must deny all container images except for those signed by organizational-approved sources.

Check Content

On each node, check that MKE is configured to only run images signed by applicable Orgs and Teams.

1. Log in to the MKE web UI and navigate to admin >> Admin Settings >> Docker Content Trust.

If Content Trust Settings "Run only signed images" is disabled, this is a finding.

2. Verify that the Orgs and Teams that images must be signed by in the drop-down matches the organizational policies.

If an Org or Team selected does not match organizational policies, this is a finding. 

3. Verify that all images sitting on an MKE cluster are signed.

Via CLI:
Linux: As an MKE Admin, execute the following commands using a client bundle:

docker trust inspect $(docker images | awk '{print $1 ":" $2}')

Verify that all image tags in the output have valid signatures. If the images are not signed, this is a finding.