Change:
For a complete list of images that are signed please refer to [Releases](/releases/download/). <del> Let's pick one image from this list and verify its signature using </del> <ins> Pick one image from this list and verify its signature using </ins> the `cosign verify` command: ```shell <del> COSIGN_EXPERIMENTAL=1 cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion >}} </del> <ins> cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion >}}  --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com  --certificate-oidc-issuer https://accounts.google.com  | jq . </ins> ``` <del> {{< note >}} `COSIGN_EXPERIMENTAL=1` is used to allow verification of images signed in `KEYLESS` mode. To learn more about keyless signing, please refer to [Keyless Signatures](https://github.com/sigstore/cosign/blob/main/KEYLESS.md#keyless-signatures) . {{< /note >}} </del> ### Verifying images for all control plane components <del> To verify all signed control plane images, please run this command: </del> <ins> To verify all signed control plane images for the latest stable version (v{{< skew currentPatchVersion >}}), please run the following commands: </ins> ```shell <del> curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release" | grep "SPDXID: SPDXRef-Package-registry.k8s.io" |  grep -v sha256 | cut -d- -f3- | sed 's/-///' | sed 's/-v1/:v1/' > images.txt </del> <ins> curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release"  | grep "SPDXID: SPDXRef-Package-registry.k8s.io"  | grep -v sha256 | cut -d- -f3- | sed 's/-///' | sed 's/-v1/:v1/'  | sort > images.txt </ins> input=images.txt while IFS= read -r image do <del> COSIGN_EXPERIMENTAL=1 cosign verify "$image" </del> <ins> cosign verify "$image"  --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com  --certificate-oidc-issuer https://accounts.google.com  | jq . </ins> done < "$input" ``` <del> Once you have verified an image, specify that image by its digest in your Pod manifests as per this example: `registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2` . </del> <ins> Once you have verified an image, you can specify the image by its digest in your Pod manifests as per this example: ```console registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2 ``` </ins> For more information, please refer <del> to [Image Pull Policy](/docs/concepts/containers/images/#image-pull-policy) </del> <ins> to the [Image Pull Policy](/docs/concepts/containers/images/#image-pull-policy) </ins> section. ## Verifying Image Signatures with Admission Controller <del> For non-control plane images ( e.g. [conformance image](https://github.com/kubernetes/kubernetes/blob/master/test/conformance/image/README.md)) , signatures can also be verified at deploy time using </del> <ins> For non-control plane images (for example [conformance image](https://github.com/kubernetes/kubernetes/blob/master/test/conformance/image/README.md)), signatures can also be verified at deploy time using </ins> [sigstore policy-controller](https://docs.sigstore.dev/policy-controller/overview) <del> admission controller. To get started with `policy-controller` here are a few helpful resources: </del> <ins> admission controller. Here are some helpful resources to get started with `policy-controller`: </ins> - [Installation](https://github.com/sigstore/helm-charts/tree/main/charts/policy-controller) - [Configuration Options](https://github.com/sigstore/policy-controller/tree/main/config)

Discussion:
This is a Feature Request After release, we don't need . We should update the instructions on the task to include verification using cosign 2.0 <!-- Please only use this template for submitting feature/enhancement requests --<!-- See for guidance on writing an actionable issue description. --What would you like to be <details<summaryverification using cosign 2.0</summaryAdd a note if cosign version < 2.0 </details<!-- Describe as precisely as possible how this feature/enhancement should work from the user perspective. What should be changed, etc. --Why is this needed There are some breaking changes in cosign 2.0 and we should update the instruction for the verification of images. Comments <!-- Any additional related comments that might help. Drawings/mockups would be extremely helpful (if required). --
/sig release /sig security /retitle Update page Verify Signed Kubernetes Artifacts for cosign 2.0 /kind bug /remove-kind feature /language en /triage accepted Thanks
:+1:
I can work on this /assign
Hey Are you still working on this issue? If not, can I work on this?
Haven't gotten to it as I expected to. Please feel free to work on it /unassign
/assign
FYI
Apologies for not being able to review the PR. I am going through University exams which is ending tomorrow. I just rushed through the changes that you made and you really did awesome work on this. I'll look more into this after the exams. Thanks for working on this.