For a complete list of images that are signed please refer to [Releases](/releases/download/). <del> Let's pick one image from this list and verify its signature using </del> <ins> Pick one image from this list and verify its signature using </ins> the `cosign verify` command: ```shell <del> COSIGN_EXPERIMENTAL=1 cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion >}} </del> <ins> cosign verify registry.k8s.io/kube-apiserver-amd64:v{{< skew currentPatchVersion >}}  --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com  --certificate-oidc-issuer https://accounts.google.com  | jq . </ins> ``` <del> {{< note >}} `COSIGN_EXPERIMENTAL=1` is used to allow verification of images signed in `KEYLESS` mode. To learn more about keyless signing, please refer to [Keyless Signatures](https://github.com/sigstore/cosign/blob/main/KEYLESS.md#keyless-signatures) . {{< /note >}} </del> ### Verifying images for all control plane components <del> To verify all signed control plane images, please run this command: </del> <ins> To verify all signed control plane images for the latest stable version (v{{< skew currentPatchVersion >}}), please run the following commands: </ins> ```shell <del> curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release" | grep "SPDXID: SPDXRef-Package-registry.k8s.io" |  grep -v sha256 | cut -d- -f3- | sed 's/-///' | sed 's/-v1/:v1/' > images.txt </del> <ins> curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release"  | grep "SPDXID: SPDXRef-Package-registry.k8s.io"  | grep -v sha256 | cut -d- -f3- | sed 's/-///' | sed 's/-v1/:v1/'  | sort > images.txt </ins> input=images.txt while IFS= read -r image do <del> COSIGN_EXPERIMENTAL=1 cosign verify "$image" </del> <ins> cosign verify "$image"  --certificate-identity krel-trust@k8s-releng-prod.iam.gserviceaccount.com  --certificate-oidc-issuer https://accounts.google.com  | jq . </ins> done < "$input" ``` <del> Once you have verified an image, specify that image by its digest in your Pod manifests as per this example: `registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2` . </del> <ins> Once you have verified an image, you can specify the image by its digest in your Pod manifests as per this example: ```console registry-url/image-name@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2 ``` </ins> For more information, please refer <del> to [Image Pull Policy](/docs/concepts/containers/images/#image-pull-policy) </del> <ins> to the [Image Pull Policy](/docs/concepts/containers/images/#image-pull-policy) </ins> section. ## Verifying Image Signatures with Admission Controller <del> For non-control plane images ( e.g. [conformance image](https://github.com/kubernetes/kubernetes/blob/master/test/conformance/image/README.md)) , signatures can also be verified at deploy time using </del> <ins> For non-control plane images (for example [conformance image](https://github.com/kubernetes/kubernetes/blob/master/test/conformance/image/README.md)), signatures can also be verified at deploy time using </ins> [sigstore policy-controller](https://docs.sigstore.dev/policy-controller/overview) <del> admission controller. To get started with `policy-controller` here are a few helpful resources: </del> <ins> admission controller. Here are some helpful resources to get started with `policy-controller`: </ins> - [Installation](https://github.com/sigstore/helm-charts/tree/main/charts/policy-controller) - [Configuration Options](https://github.com/sigstore/policy-controller/tree/main/config)