Connaisseur Versions Save

An admission controller that integrates Container Image Signature Verification into a Kubernetes cluster

v3.4.0

1 month ago

Connaisseur v3.4.0

Big news: We are switching programming languages from Python to Golang! 🎉💯 See #1513

Notable features

  • The policy rules now support a with.mode option that can be set to mutate or insecureValidateOnly, allowing the mutation of the image reference to be toggled on and off (the default is mutate, meaning references will be mutated; the alternative is considered insecure since it implies that while a trusted image is available, its use is not guaranteed 🤷).
  • A caching mechanism in the form of a Redis key-value store now stores the results of a validation for 30 seconds.
  • A new feature flag, resourceValidationMode, with supported values all and podsOnly. all is the default, causing Connaisseur to block all resources if they fail validation and mutate them if they pass. podsOnly will still validate all resources but only block and mutate Pod resources, while others are passed through with a warning (similar to PSA). This enhances compatibility with GitOps solutions like ArgoCD by preventing diffs on each reconciliation.
  • Notary now supports all TUF compliant keys.
  • Setting the with.trustRoot to * for a policy is now supported across all validators, allowing AND conjunctions for all defined trust roots within a validator.
  • Custom labels can be added (thanks to @jimonthebarn)

v3.3.4

2 months ago

v3.3.4

Refactor

Build

Ci

Test

Docs

Update

What's Changed

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v3.3.3...v3.3.4

v3.3.3

3 months ago

v3.3.3

Fix

Build

Update

What's Changed

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v3.3.2...v3.3.3

v3.3.2

4 months ago

What's Changed

New Contributors

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v3.3.1...v3.3.2

v3.3.2

Ci

Test

Update

v3.3.1

5 months ago

What's Changed

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v3.3.0...v3.3.1

Connaisseur v3.3.1

Sec

Fix

Build

Ci

Test

Docs

Update

v3.3.0

5 months ago

What's Changed

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v3.2.0...v3.3.0

v3.3.0

Feat

Fix

Build

Ci

Test

Docs

Update

v3.2.0

6 months ago

What's Changed

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v3.1.1...v3.2.0

v3.2.0

Feat

Fix

Refactor

Ci

Test

Docs

Update

v3.1.1

6 months ago

Fixed some automation problem, which hampered release v3.1.0

What's Changed

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v3.1.0...v3.1.1

v3.1.0

6 months ago

⚠️ This release has been fixed by release v3.1.1

What's Changed

thanks to @FalacerSelene @hsudbrock @jacobkoren1 and @b3n3d17

v3.1.0

Feat

  • Add pod securitycontext to helm chart

Fix

Refactor

Ci

Update

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v3.0.0...v3.1.0

v3.0.0

10 months ago

More details on the changes are in our documentation

v3.0.0

Feat

  • Add serviceaccount annotations to allow irsa
  • Support RSA public keys for Cosign
  • Update to Cosign 2.0 and switch to asyncio
  • Add upgrade script
  • Common ancestor for Kubernetes resource configurations
  • Create MS Teams alert template

Fix

  • Remove old config of Rekor url
  • Helm error when setting auth username and password

Refactor

  • Feature flag utility
  • Dev logging for dev install
  • Changed logging format to JSON
  • Allow all commented-out config keys to be uncommented and then be valid yaml
  • Consistency in feature enablement
  • Split off webhook configuration
  • Group application configuration under single key
  • Remove debug config key
  • Improve naming within alerting configuration
  • Add Rekor subkey for Cosign host config key
  • Consistent config key naming (except alerting)

Build

  • Default to appversion

Ci

  • Less verbose values.yaml debug

Test

  • Remove legacy k8s tests
  • Only run alerting for tests that use it
  • Add object descriptions in error case

Docs

  • Fix release documentation
  • Added migration steps
  • Fix announcement link
  • Fix scripts link
  • Add Connaisseur 3 announcement to docs
  • Fix default values
  • Consistent no/none representation for default and not required values
  • Correct alerting documentation
  • Add migration documentation

Update

  • Bump ossf/scorecard-action from 2.1.3 to 2.2.0
  • Bump bridgecrewio/checkov-action from 12.2393.0 to 12.2401.0
  • Update mkdocs-material requirement from ~=9.1.16 to ~=9.1.17
  • Bump github/codeql-action from 2.20.0 to 2.20.1
  • Bump anchore/sbom-action from 0.14.2 to 0.14.3
  • Update setuptools requirement from ~=67.8.0 to ~=68.0.0
  • Update mkdocs-material requirement from ~=9.1.15 to ~=9.1.16
  • Update pytest-mock requirement from ~=3.10.0 to ~=3.11.1
  • Bump bridgecrewio/checkov-action from 12.2382.0 to 12.2393.0
  • Bump github/codeql-action from 2.3.6 to 2.20.0
  • Bump actions/checkout from 3.5.2 to 3.5.3
  • Update requests-mock requirement from ~=1.10.0 to ~=1.11.0
  • Bump docker/login-action from 2.1.0 to 2.2.0
  • Updating more dependencies

What's Changed

New Contributors

Full Changelog: https://github.com/sse-secure-systems/connaisseur/compare/v2.8.1...v3.0.0