Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: unknown error

[bally-singh]

Hi Team,

I am using AKS and ACR and the following has been set in the values.yaml file:

• name: default
  type: notaryv1 # or other supported validator (e.g. "cosign")
  host: ballyacr123.azurecr.io # in case of notaryv1, configure the notary server to be used
  auth.username: Azure App ID
  auth.password: Azure App ID Password
  is_acr: true
  trust_roots:
  '#' the default key is used if no key is specified in image policy
  • name: default
    key: | # enter your public key below
    -----BEGIN PUBLIC KEY-----
    docker trust key generate - public certificate added
    -----END PUBLIC KEY-----

However, when I try to pull an image I get the following error message:

Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: unknown error. please check the logs.

If I uninstall connaisseur, I am able to successfully pull the docker image.

Is there something I am missing in my configuration?

[xopham]

Hi @bally-singh ,
it seems like you did follow the ACR specific instructions.

Most strikingly, your auth configugartion won't work. It should be:

auth:
  username: Azure App ID
  password: Azure App ID Password

In the docs, we just used the auth.username notation to express the hierarchy in case of sub-keys. However, in the actual configuration the correct yaml notation must be used.
Let me know if that solves your problem. I have a few more notes below:

---

• Just to be on the safe side: the actual key in your sample yaml looks somewhat like the following:

'#' the default key is used if no key is specified in image policy
name: default
key: | # enter your public key below
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOXYta5TgdCwXTCnLU09W5T4M4r9f
QQrqJuADP6U7g5r9ICgPSmZuRHP/1AYUfOQW3baveKsT969EfELKj1lfCA==
-----END PUBLIC KEY-----

I am not entirely certain what you mean by docker trust key generate - public certificate added. Could you explain?

• Another useful information for debugging would be the actual Connaisseur log output. You can get it via:

kubectl logs -n connaisseur connaisseur-deployment-<ID of your pod(s)>

You might have to check separately for all Pods you are running.

[bally-singh]

Hi Xopham,

Many thanks for your reply.

Once I add the configuration values correctly it has started working!

Just a couple of additional things that I was hoping you could assist with:

Using Secret

The preference would be to use a secret, so I would need to do the following:

• Create auth.yaml file containing "username: Azure APP ID" & "password: Azure APP ID Password"
• kubectl create secret generic kube-secret-name --from-file auth.yaml
• Then set the value secret_name: kube-secret-name

Is that correct?

rsa-x509' is not one of ['ecdsa']

I also used my own self-signed certificates and I got this error:

Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: Trust data targets has an invalid format: 'rsa-x509' is not one of ['ecdsa']

Failed validating 'enum' in schema['properties']['signed']['properties']['delegations']['properties']['keys']['patternProperties']['^[a-f\d]{64}$']['properties']['keytype']:
{'enum': ['ecdsa'], 'type': 'string'}

On instance['signed']['delegations']['keys']['f65064d0d36aa286e9414ac8809742bf0e1386e5be655bb3db2e9e0c0ca71f7a']['keytype']:
'rsa-x509'.

Do I need to use correctly signed certificates for the solution to work?

[xopham]

Awesome. Happy to hear it worked 👍 I took the liberty to mark the above response as answer.
As to your new questions:

Using Secret

The steps you describe seem correct, as described in the docs. The auth.yaml should have the structure:

username: <user>
password: <password>

rsa-x509

You want to use this as a public key certificate for the image signing public key, right? This seems related to #99 . rsa-x509 is not supported so far, but as this seems to be more common, we will try to prioritize for future development.
Could you let me know how you created the certificate to facilitate testing?

Let me know if this helps 🙂

[bally-singh]

Hey Xopham,

I believe I created the certificate using:

openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem

However, I will try to switch to the docker generated key.

Many thanks again for all your help!