mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Code Activity

feat: update verify images types with better descriptions (#8779)

Browse source 
* feat: update verify images types with better descriptions

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: revert cert and certchain

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Vishal Choudhary 2023-10-31 10:22:07 +05:30 committed by GitHub
parent fb530626ba
commit 99c5f66fab
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 8820 additions and 6978 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
api/kyverno/v1/image_verification_types.go
View file

@ -96,11 +96,11 @@ type ImageVerification struct {
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Required bool `json:"required" yaml:"required"` Required bool `json:"required" yaml:"required"`
// ImageRegistryCredentials provides credentials that will be used for authentication with registry // ImageRegistryCredentials provides credentials that will be used for authentication with registry.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
ImageRegistryCredentials *ImageRegistryCredentials `json:"imageRegistryCredentials,omitempty" yaml:"imageRegistryCredentials,omitempty"` ImageRegistryCredentials *ImageRegistryCredentials `json:"imageRegistryCredentials,omitempty" yaml:"imageRegistryCredentials,omitempty"`
// UseCache enables caching of image verify responses for this rule // UseCache enables caching of image verify responses for this rule.
// +kubebuilder:default=true // +kubebuilder:default=true
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
UseCache bool `json:"useCache" yaml:"useCache"` UseCache bool `json:"useCache" yaml:"useCache"`
@ -128,11 +128,11 @@ func (as AttestorSet) RequiredCount() int {
} }
type Attestor struct { type Attestor struct {
// Keys specifies one or more public keys // Keys specifies one or more public keys.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Keys *StaticKeyAttestor `json:"keys,omitempty" yaml:"keys,omitempty"` Keys *StaticKeyAttestor `json:"keys,omitempty" yaml:"keys,omitempty"`
// Certificates specifies one or more certificates // Certificates specifies one or more certificates.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Certificates *CertificateAttestor `json:"certificates,omitempty" yaml:"certificates,omitempty"` Certificates *CertificateAttestor `json:"certificates,omitempty" yaml:"certificates,omitempty"`
@ -141,7 +141,7 @@ type Attestor struct {
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Keyless *KeylessAttestor `json:"keyless,omitempty" yaml:"keyless,omitempty"` Keyless *KeylessAttestor `json:"keyless,omitempty" yaml:"keyless,omitempty"`
// Attestor is a nested AttestorSet used to specify a more complex set of match authorities // Attestor is a nested set of Attestor used to specify a more complex set of match authorities.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Attestor *apiextv1.JSON `json:"attestor,omitempty" yaml:"attestor,omitempty"` Attestor *apiextv1.JSON `json:"attestor,omitempty" yaml:"attestor,omitempty"`
@ -166,7 +166,7 @@ type StaticKeyAttestor struct {
// (.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys. // (.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
PublicKeys string `json:"publicKeys,omitempty" yaml:"publicKeys,omitempty"` PublicKeys string `json:"publicKeys,omitempty" yaml:"publicKeys,omitempty"`
// Specify signature algorithm for public keys. Supported values are sha256 and sha512 // Specify signature algorithm for public keys. Supported values are sha256 and sha512.
// +kubebuilder:default=sha256 // +kubebuilder:default=sha256
SignatureAlgorithm string `json:"signatureAlgorithm,omitempty" yaml:"signatureAlgorithm,omitempty"` SignatureAlgorithm string `json:"signatureAlgorithm,omitempty" yaml:"signatureAlgorithm,omitempty"`
@ -182,8 +182,8 @@ type StaticKeyAttestor struct {
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Rekor *Rekor `json:"rekor,omitempty" yaml:"rekor,omitempty"` Rekor *Rekor `json:"rekor,omitempty" yaml:"rekor,omitempty"`
// CTLog provides configuration for validation of SCTs. // CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
// If the value is nil, default ctlog public key is used // Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
CTLog *CTLog `json:"ctlog,omitempty" yaml:"ctlog,omitempty"` CTLog *CTLog `json:"ctlog,omitempty" yaml:"ctlog,omitempty"`
} }
@ -197,11 +197,11 @@ type SecretReference struct {
} }
type CertificateAttestor struct { type CertificateAttestor struct {
// Certificate is an optional PEM encoded public certificate. // Cert is an optional PEM-encoded public certificate.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Certificate string `json:"cert,omitempty" yaml:"cert,omitempty"` Certificate string `json:"cert,omitempty" yaml:"cert,omitempty"`
// CertificateChain is an optional PEM encoded set of certificates used to verify // CertChain is an optional PEM encoded set of certificates used to verify.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
CertificateChain string `json:"certChain,omitempty" yaml:"certChain,omitempty"` CertificateChain string `json:"certChain,omitempty" yaml:"certChain,omitempty"`
@ -210,8 +210,8 @@ type CertificateAttestor struct {
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Rekor *Rekor `json:"rekor,omitempty" yaml:"rekor,omitempty"` Rekor *Rekor `json:"rekor,omitempty" yaml:"rekor,omitempty"`
// CTLog provides configuration for validation of SCTs. // CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
// If the value is nil, default ctlog public key is used // Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
CTLog *CTLog `json:"ctlog,omitempty" yaml:"ctlog,omitempty"` CTLog *CTLog `json:"ctlog,omitempty" yaml:"ctlog,omitempty"`
} }
@ -222,8 +222,8 @@ type KeylessAttestor struct {
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Rekor *Rekor `json:"rekor,omitempty" yaml:"rekor,omitempty"` Rekor *Rekor `json:"rekor,omitempty" yaml:"rekor,omitempty"`
// CTLog provides configuration for validation of SCTs. // CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
// If the value is nil, default ctlog public key is used // Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
CTLog *CTLog `json:"ctlog,omitempty" yaml:"ctlog,omitempty"` CTLog *CTLog `json:"ctlog,omitempty" yaml:"ctlog,omitempty"`
@ -231,7 +231,7 @@ type KeylessAttestor struct {
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Issuer string `json:"issuer,omitempty" yaml:"issuer,omitempty"` Issuer string `json:"issuer,omitempty" yaml:"issuer,omitempty"`
// Subject is the verified identity used for keyless signing, for example the email address // Subject is the verified identity used for keyless signing, for example the email address.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Subject string `json:"subject,omitempty" yaml:"subject,omitempty"` Subject string `json:"subject,omitempty" yaml:"subject,omitempty"`
@ -246,27 +246,28 @@ type KeylessAttestor struct {
} }
type Rekor struct { type Rekor struct {
// URL is the address of the transparency log. Defaults to the public log https://rekor.sigstore.dev. // URL is the address of the transparency log. Defaults to the public Rekor log instance https://rekor.sigstore.dev.
// +kubebuilder:validation:Required // +kubebuilder:validation:Required
// +kubebuilder:Default:=https://rekor.sigstore.dev // +kubebuilder:Default:=https://rekor.sigstore.dev
URL string `json:"url" yaml:"url"` URL string `json:"url" yaml:"url"`
// RekorPubKey is an optional PEM encoded public key to use for a custom Rekor. // RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
// If set, is used to validate signatures on log entries from Rekor. // If set, this will be used to validate transparency log signatures from a custom Rekor.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
RekorPubKey string `json:"pubkey,omitempty" yaml:"pubkey,omitempty"` RekorPubKey string `json:"pubkey,omitempty" yaml:"pubkey,omitempty"`
// IgnoreTlog skip tlog verification // IgnoreTlog skips transparency log verification.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
IgnoreTlog bool `json:"ignoreTlog,omitempty" yaml:"ignoreTlog,omitempty"` IgnoreTlog bool `json:"ignoreTlog,omitempty" yaml:"ignoreTlog,omitempty"`
} }
type CTLog struct { type CTLog struct {
// IgnoreSCT requires that a certificate contain an embedded SCT during verification. // IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
// timestamp. Default is false. Set to true if this was opted out during signing.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
IgnoreSCT bool `json:"ignoreSCT,omitempty" yaml:"ignoreSCT,omitempty"` IgnoreSCT bool `json:"ignoreSCT,omitempty" yaml:"ignoreSCT,omitempty"`
// CTLogPubKey, if set, is used to validate SCTs against those keys. // PubKey, if set, is used to validate SCTs against a custom source.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
CTLogPubKey string `json:"pubkey,omitempty" yaml:"pubkey,omitempty"` CTLogPubKey string `json:"pubkey,omitempty" yaml:"pubkey,omitempty"`
} }
@ -283,7 +284,7 @@ type Attestation struct {
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Type string `json:"type" yaml:"type"` Type string `json:"type" yaml:"type"`
// Attestors specify the required attestors (i.e. authorities) // Attestors specify the required attestors (i.e. authorities).
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Attestors []AttestorSet `json:"attestors" yaml:"attestors"` Attestors []AttestorSet `json:"attestors" yaml:"attestors"`
@ -294,17 +295,17 @@ type Attestation struct {
} }
type ImageRegistryCredentials struct { type ImageRegistryCredentials struct {
// AllowInsecureRegistry allows insecure access to a registry // AllowInsecureRegistry allows insecure access to a registry.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
AllowInsecureRegistry bool `json:"allowInsecureRegistry,omitempty" yaml:"allowInsecureRegistry,omitempty"` AllowInsecureRegistry bool `json:"allowInsecureRegistry,omitempty" yaml:"allowInsecureRegistry,omitempty"`
// Providers specifies a list of OCI Registry names, whose authentication providers are provided // Providers specifies a list of OCI Registry names, whose authentication providers are provided.
// It can be of one of these values: default,google,azure,amazon,github // It can be of one of these values: default,google,azure,amazon,github.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Providers []ImageRegistryCredentialsProvidersType `json:"providers,omitempty" yaml:"providers,omitempty"` Providers []ImageRegistryCredentialsProvidersType `json:"providers,omitempty" yaml:"providers,omitempty"`
// Secrets specifies a list of secrets that are provided for credentials // Secrets specifies a list of secrets that are provided for credentials.
// Secrets must live in the Kyverno namespace // Secrets must live in the Kyverno namespace.
// +kubebuilder:validation:Optional // +kubebuilder:validation:Optional
Secrets []string `json:"secrets,omitempty" yaml:"secrets,omitempty"` Secrets []string `json:"secrets,omitempty" yaml:"secrets,omitempty"`
} }

3932
charts/kyverno/charts/crds/templates/crds.yaml
View file

File diff suppressed because it is too large Load diff

1946
cmd/cli/kubectl-kyverno/data/crds/kyverno.io_clusterpolicies.yaml
View file

File diff suppressed because it is too large Load diff

1946
cmd/cli/kubectl-kyverno/data/crds/kyverno.io_policies.yaml
View file

File diff suppressed because it is too large Load diff

20
config/crds/kyverno.io_cleanuppolicies.yaml
View file

@ -226,12 +226,12 @@ spec:
properties: properties:
allowInsecureRegistry: allowInsecureRegistry:
description: AllowInsecureRegistry allows insecure access description: AllowInsecureRegistry allows insecure access
to a registry to a registry.
type: boolean type: boolean
providers: providers:
description: 'Providers specifies a list of OCI Registry description: 'Providers specifies a list of OCI Registry
names, whose authentication providers are provided names, whose authentication providers are provided.
It can be of one of these values: default,google,azure,amazon,github' It can be of one of these values: default,google,azure,amazon,github.'
items: items:
description: ImageRegistryCredentialsProvidersType description: ImageRegistryCredentialsProvidersType
provides the list of credential providers required. provides the list of credential providers required.
@ -245,8 +245,8 @@ spec:
type: array type: array
secrets: secrets:
description: Secrets specifies a list of secrets that description: Secrets specifies a list of secrets that
are provided for credentials Secrets must live in are provided for credentials. Secrets must live in
the Kyverno namespace the Kyverno namespace.
items: items:
type: string type: string
type: array type: array
@ -1467,12 +1467,12 @@ spec:
properties: properties:
allowInsecureRegistry: allowInsecureRegistry:
description: AllowInsecureRegistry allows insecure access description: AllowInsecureRegistry allows insecure access
to a registry to a registry.
type: boolean type: boolean
providers: providers:
description: 'Providers specifies a list of OCI Registry description: 'Providers specifies a list of OCI Registry
names, whose authentication providers are provided names, whose authentication providers are provided.
It can be of one of these values: default,google,azure,amazon,github' It can be of one of these values: default,google,azure,amazon,github.'
items: items:
description: ImageRegistryCredentialsProvidersType description: ImageRegistryCredentialsProvidersType
provides the list of credential providers required. provides the list of credential providers required.
@ -1486,8 +1486,8 @@ spec:
type: array type: array
secrets: secrets:
description: Secrets specifies a list of secrets that description: Secrets specifies a list of secrets that
are provided for credentials Secrets must live in are provided for credentials. Secrets must live in
the Kyverno namespace the Kyverno namespace.
items: items:
type: string type: string
type: array type: array

20
config/crds/kyverno.io_clustercleanuppolicies.yaml
View file

@ -226,12 +226,12 @@ spec:
properties: properties:
allowInsecureRegistry: allowInsecureRegistry:
description: AllowInsecureRegistry allows insecure access description: AllowInsecureRegistry allows insecure access
to a registry to a registry.
type: boolean type: boolean
providers: providers:
description: 'Providers specifies a list of OCI Registry description: 'Providers specifies a list of OCI Registry
names, whose authentication providers are provided names, whose authentication providers are provided.
It can be of one of these values: default,google,azure,amazon,github' It can be of one of these values: default,google,azure,amazon,github.'
items: items:
description: ImageRegistryCredentialsProvidersType description: ImageRegistryCredentialsProvidersType
provides the list of credential providers required. provides the list of credential providers required.
@ -245,8 +245,8 @@ spec:
type: array type: array
secrets: secrets:
description: Secrets specifies a list of secrets that description: Secrets specifies a list of secrets that
are provided for credentials Secrets must live in are provided for credentials. Secrets must live in
the Kyverno namespace the Kyverno namespace.
items: items:
type: string type: string
type: array type: array
@ -1467,12 +1467,12 @@ spec:
properties: properties:
allowInsecureRegistry: allowInsecureRegistry:
description: AllowInsecureRegistry allows insecure access description: AllowInsecureRegistry allows insecure access
to a registry to a registry.
type: boolean type: boolean
providers: providers:
description: 'Providers specifies a list of OCI Registry description: 'Providers specifies a list of OCI Registry
names, whose authentication providers are provided names, whose authentication providers are provided.
It can be of one of these values: default,google,azure,amazon,github' It can be of one of these values: default,google,azure,amazon,github.'
items: items:
description: ImageRegistryCredentialsProvidersType description: ImageRegistryCredentialsProvidersType
provides the list of credential providers required. provides the list of credential providers required.
@ -1486,8 +1486,8 @@ spec:
type: array type: array
secrets: secrets:
description: Secrets specifies a list of secrets that description: Secrets specifies a list of secrets that
are provided for credentials Secrets must live in are provided for credentials. Secrets must live in
the Kyverno namespace the Kyverno namespace.
items: items:
type: string type: string
type: array type: array

1946
config/crds/kyverno.io_clusterpolicies.yaml
View file

File diff suppressed because it is too large Load diff

1946
config/crds/kyverno.io_policies.yaml
View file

File diff suppressed because it is too large Load diff

3932
config/install-latest-testing.yaml
View file

File diff suppressed because it is too large Load diff

55
docs/user/crd/index.html
View file

@ -792,7 +792,7 @@ string
</em> </em>
</td> </td>
<td> <td>
<p>Attestors specify the required attestors (i.e. authorities)</p> <p>Attestors specify the required attestors (i.e. authorities).</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -838,7 +838,7 @@ StaticKeyAttestor
</em> </em>
</td> </td>
<td> <td>
<p>Keys specifies one or more public keys</p> <p>Keys specifies one or more public keys.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -851,7 +851,7 @@ CertificateAttestor
</em> </em>
</td> </td>
<td> <td>
<p>Certificates specifies one or more certificates</p> <p>Certificates specifies one or more certificates.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -878,7 +878,7 @@ Kubernetes apiextensions/v1.JSON
</em> </em>
</td> </td>
<td> <td>
<p>Attestor is a nested AttestorSet used to specify a more complex set of match authorities</p> <p>Attestor is a nested set of Attestor used to specify a more complex set of match authorities.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -1109,7 +1109,8 @@ bool
</em> </em>
</td> </td>
<td> <td>
<p>IgnoreSCT requires that a certificate contain an embedded SCT during verification.</p> <p>IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
timestamp. Default is false. Set to true if this was opted out during signing.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -1120,7 +1121,7 @@ string
</em> </em>
</td> </td>
<td> <td>
<p>CTLogPubKey, if set, is used to validate SCTs against those keys.</p> <p>PubKey, if set, is used to validate SCTs against a custom source.</p>
</td> </td>
</tr> </tr>
</tbody> </tbody>
@ -1150,7 +1151,7 @@ string
</em> </em>
</td> </td>
<td> <td>
<p>Certificate is an optional PEM encoded public certificate.</p> <p>Cert is an optional PEM-encoded public certificate.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -1161,7 +1162,7 @@ string
</em> </em>
</td> </td>
<td> <td>
<p>CertificateChain is an optional PEM encoded set of certificates used to verify</p> <p>CertChain is an optional PEM encoded set of certificates used to verify.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -1188,8 +1189,8 @@ CTLog
</em> </em>
</td> </td>
<td> <td>
<p>CTLog provides configuration for validation of SCTs. <p>CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
If the value is nil, default ctlog public key is used</p> Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.</p>
</td> </td>
</tr> </tr>
</tbody> </tbody>
@ -2085,7 +2086,7 @@ bool
</em> </em>
</td> </td>
<td> <td>
<p>AllowInsecureRegistry allows insecure access to a registry</p> <p>AllowInsecureRegistry allows insecure access to a registry.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -2098,8 +2099,8 @@ bool
</em> </em>
</td> </td>
<td> <td>
<p>Providers specifies a list of OCI Registry names, whose authentication providers are provided <p>Providers specifies a list of OCI Registry names, whose authentication providers are provided.
It can be of one of these values: default,google,azure,amazon,github</p> It can be of one of these values: default,google,azure,amazon,github.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -2110,8 +2111,8 @@ It can be of one of these values: default,google,azure,amazon,github</p>
</em> </em>
</td> </td>
<td> <td>
<p>Secrets specifies a list of secrets that are provided for credentials <p>Secrets specifies a list of secrets that are provided for credentials.
Secrets must live in the Kyverno namespace</p> Secrets must live in the Kyverno namespace.</p>
</td> </td>
</tr> </tr>
</tbody> </tbody>
@ -2335,7 +2336,7 @@ ImageRegistryCredentials
</em> </em>
</td> </td>
<td> <td>
<p>ImageRegistryCredentials provides credentials that will be used for authentication with registry</p> <p>ImageRegistryCredentials provides credentials that will be used for authentication with registry.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -2346,7 +2347,7 @@ bool
</em> </em>
</td> </td>
<td> <td>
<p>UseCache enables caching of image verify responses for this rule</p> <p>UseCache enables caching of image verify responses for this rule.</p>
</td> </td>
</tr> </tr>
</tbody> </tbody>
@ -2402,8 +2403,8 @@ CTLog
</em> </em>
</td> </td>
<td> <td>
<p>CTLog provides configuration for validation of SCTs. <p>CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
If the value is nil, default ctlog public key is used</p> Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -2425,7 +2426,7 @@ string
</em> </em>
</td> </td>
<td> <td>
<p>Subject is the verified identity used for keyless signing, for example the email address</p> <p>Subject is the verified identity used for keyless signing, for example the email address.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -2969,7 +2970,7 @@ string
</em> </em>
</td> </td>
<td> <td>
<p>URL is the address of the transparency log. Defaults to the public log <a href="https://rekor.sigstore.dev">https://rekor.sigstore.dev</a>.</p> <p>URL is the address of the transparency log. Defaults to the public Rekor log instance <a href="https://rekor.sigstore.dev">https://rekor.sigstore.dev</a>.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -2980,8 +2981,8 @@ string
</em> </em>
</td> </td>
<td> <td>
<p>RekorPubKey is an optional PEM encoded public key to use for a custom Rekor. <p>RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
If set, is used to validate signatures on log entries from Rekor.</p> If set, this will be used to validate transparency log signatures from a custom Rekor.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -2992,7 +2993,7 @@ bool
</em> </em>
</td> </td>
<td> <td>
<p>IgnoreTlog skip tlog verification</p> <p>IgnoreTlog skips transparency log verification.</p>
</td> </td>
</tr> </tr>
</tbody> </tbody>
@ -3882,7 +3883,7 @@ string
</em> </em>
</td> </td>
<td> <td>
<p>Specify signature algorithm for public keys. Supported values are sha256 and sha512</p> <p>Specify signature algorithm for public keys. Supported values are sha256 and sha512.</p>
</td> </td>
</tr> </tr>
<tr> <tr>
@ -3934,8 +3935,8 @@ CTLog
</em> </em>
</td> </td>
<td> <td>
<p>CTLog provides configuration for validation of SCTs. <p>CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
If the value is nil, default ctlog public key is used</p> Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.</p>
</td> </td>
</tr> </tr>
</tbody> </tbody>