Connaisseur – Kubernetes image signature verification

Connaisseur is a Kubernetes admission controller that verifies the authenticity of container images before they are deployed to a cluster. It integrates with the Kubernetes admission process to examine image references in resource creation and update requests, checking whether the images satisfy configured trust policies.

The application uses cryptographic signatures and trusted public keys to determine whether an image originates from an authorised source. When verification succeeds, Connaisseur can replace a mutable image reference with a trusted immutable digest, preventing a different image from being retrieved after the initial verification. Requests containing images that fail validation are normally rejected. Administrators can define policies for different image repositories, configure trusted signing authorities and control how validation is applied across namespaces. Connaisseur also provides monitoring-oriented modes that allow signature problems to be detected before strict enforcement is introduced.

This is free and open source software.

Key Features

• Verify container image signatures during Kubernetes admission requests.
• Reject deployments containing images that fail configured trust policies.
• Support Notary, Docker Content Trust, Sigstore/Cosign and Notation signatures.
• Configure trusted public keys and signing authorities.
• Pin validated container images to immutable digests.
• Define image validation policies using repository and image patterns.
• Use static allow and deny validators for selected images.
• Detection mode warns about untrusted images without blocking deployment.
• Restrict validation to selected Kubernetes namespaces.
• Configure namespace exclusions for controlled deployment rollouts.
• Send admission and rejection notifications to external services.
• Built-in alert integrations for Slack, Opsgenie, Keybase and Microsoft Teams.
• Support custom JSON alert payloads and REST endpoints.
• Export structured notifications using Elastic Common Schema.
• Configure failure behaviour when validation services are unavailable.
• Support private registries and authenticated registry access.
• Apply different validators and trust roots to different image repositories.

Website: github.com/sse-secure-systems/connaisseur
Support:
Developer: Secure Systems Engineering
License: Apache License 2.0

Connaisseur is written in Go. Learn Go with our recommended free books and free tutorials.

LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software. We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README.