ECR Support with Connaisseur

[allanedwardslab651]

We are running 2 flavors of Kubernetes outside of ECR. They are Microk8s and OpenShift. Both environments run external to ECR. Is there any documentation on integrating Connaisseur with ECR from an external K8s?

[Starkteetje]

Hi @allanedwardslab651
if I understand your question correctly, you're running Connaisseur in one cluster and want to use it as an AdmissionController for another cluster, is that correct?

If so, there's no dedicated support page for it, but it should be easily doable (which would be independent of the underlying clusters):

1. Configure and deploy the Connaisseur application within its cluster A
2. Make it (publicly or otherwise) accessible to the second cluster B, e.g. with an ingress route to the Connaisseur service in cluster A
3. Copy the definition of the MutatingWebhookConfiguration from cluster A to B (you won't be able to simply do a limited Helm deploy in cluster B as the configuration contains the newly generated TLS certificate of Connaisseur (unless you're serving Connaisseur with a custom certificate)), while adapting the clientConfig field from the usual service configuration to a URL configuration linking to the endpoint you made accessible in step 2 in cluster A

Taken together, this leads to a deployment of the Connaisseur service in cluster A (service for validation) and the webhook configuration (i.e. admission controller) in cluster B referencing Connaisseur in cluster A.

I hope that helps. Cheers

[allanedwardslab651]

Sorry, I confused the question mentioning we had 2 clusters. We only need each cluster to access ecr directly. We don't need cluster to cluster support... But thank you for the quick response.

[Starkteetje]

In that case, what exactly is your question? IIrc, ECR does not feature a notary server and we haven't come around to implemeting notation support yet, so I'll assume you want to validate Cosign signatures?

Generally, all registries work the same from Connaisseur's view (except for ACR, but that's just a technicality), so our basic getting started documentation should suffice. In the base case, you'll need a docker config secret to access the ECR from within the cluster and that should be it.

Hope that gives you the right pointers. If it doesn't help you, it would be helpful if you could include a bit more information about where things are going wrong, such as errors (Helm, Connaisseur or k8s), what you're trying to deploy e.g. Connaisseur version and relevant parts of the values.yaml