CONNAISSEUR 2.0 released!

[xopham]

Connaisseur 2.0 is available now 🎉

As announced end of April and after several months of hard work, Connaisseur 2.0 is finally here! Thanks to the great feedback from the community, we were able to tailor Connaisseur better to the needs of a modern container image signature infrastructure.

Based on the comments, issues, GitHub Discussions and other communication, we re-designed the configuration and modularized Connaisseur to make it more flexible and performant and for example include different signing solutions, multiple keys and registries. The main features of this release are:

• multi-key support 🔑🗝️🔑
• multi-validator support 🕵️👮🕵️‍♀️👮‍♂️
• overall better usability 🛠️
• improved Cosign support (incl. auth. for private registries) ✍️
• all new documentation 📝

Our new documentation is the best way to get started using version 2.0 🚀

Major changes are associated with:

• ADR-3: Multi-Notary Configuration
• ADR-4: Modular Validation

You can find more details and all new features in the release notes. Two exciting ones are:

• added get_root_key utility: a utility to extract the public root key from Notary trust data of any DCT-signed image
• new ignore/validate label namespacebased validation: much more flexible namespaced validation support

We really appreciate input from the community, so please keep sharing your feedback and ideas on the new version either as a comment below, a GitHub Discussion, an issue or contribute directly via a PR 🙏

❗Note: This is a major release as the user-facing configuration had to be adjusted which makes this a breaking change. Users that have using versions 1.x.x in a cluster and want to switch to version 2.0.0 now, should delete CustomResourceDefinition of Connaisseur that is used to validate the configuration and not typically deleted when uninstalling. This can be achieved via kubectl delete customresourcedefinitions imagepolicies.connaisseur.policy.

What's up next? ⏭️

With the next releases, we aim to focus on performance, patching and stability improvements like increasing parallelization, implementing a more performant server and load tests. Furthermore, as Cosign is bound for its 1.0 release, we will extend integration into Connaisseur exposing some of the more advanced features.

[xopham]

@devopstales this release also fixes the shortcomings you mentioned in your write-up. Thanks for the feedback 🙏 much appreciated!

[apopaa]

Is there an equivalent in 2.0 of the 1.5 "make annihilate"? I'm trying to uninstall 2.0 but it is failing:
helm uninstall connaisseur --namespace connaisseur
Error: warning: Hook pre-delete connaisseur/templates/webhook/job.yaml failed: Internal error occurred: failed calling webhook "connaisseur-svc.connaisseur.svc": Post https://connaisseur-svc.connaisseur.svc:443/mutate?timeout=30s: context deadline exceeded
bash-5.1#
bash-5.1#
bash-5.1# helm uninstall connaisseur --namespace connaisseur
Error: warning: Hook pre-delete connaisseur/templates/webhook/role.yaml failed: clusterroles.rbac.authorization.k8s.io "connaisseur-hook-role" already exists

UPDATE:
I ended up doing this, I hope it's the right thing; would be nice to have one command that does it all:
helm uninstall connaisseur --namespace connaisseur
kubectl delete all,mutatingwebhookconfigurations,clusterroles,clusterrolebindings,configmaps,imagepolicies,secrets,serviceaccounts,crds -lapp.kubernetes.io/instance=connaisseur
kubectl delete ns connaisseur

[xopham]

Yes that should work. Actually the Makefile and thus make annihilate is still there. There is a seperate section in the docs: https://sse-secure-systems.github.io/connaisseur/v2.0.0/basics/#makefile

And we did extend the helm uninstall instructions: https://sse-secure-systems.github.io/connaisseur/v2.0.0/basics/#delete

Both installation and uninstallation can be a bit tricky bc the order is so critical as one otherwise ends in blocked state. We hope that improved a bit 🙏

In day-to-day situations actually the simple helm uninstall should suffice and we improved it somewhat. Also we'll be looking into upgrading as that is still an open flank. It's capture in #181

[devopstales]

@xopham Thanks for the update. I will test this new version and update my post.

[devopstales]

@xopham The new version is awesome. I updated the post.

[xopham]

@devopstales thanks. Awesome blog post 🙂