Merge pull request #4832 from ginglis13/image-verifiers

ginglis13 · web-flow · commit da3320ac659a · 2026-06-09T15:22:38.000-07:00
Add containerd image verification to k8s and expand ecs-3/ecs-4 verifiers
diff --git a/Release.toml b/Release.toml
@@ -1,4 +1,4 @@
-version = "1.62.0"
+version = "1.63.0"
 
 [migrations]
 "(0.3.1, 0.3.2)" = ["migrate_v0.3.2_admin-container-v0-5-0.lz4"]
@@ -470,3 +470,6 @@ version = "1.62.0"
 ]
 "(1.60.0, 1.61.0)" = []
 "(1.61.0, 1.62.0)" = []
+"(1.62.0, 1.63.0)" = [
+    "migrate_v1.63.0_image-verifier-plugins-settings.lz4",
+]
diff --git a/Twoliter.toml b/Twoliter.toml
@@ -1,5 +1,5 @@
 schema-version = 2
-release-version = "1.62.0"
+release-version = "1.63.0"
 project-vendor = "Bottlerocket"
 
 [vendor.bottlerocket]
diff --git a/sources/Cargo.lock b/sources/Cargo.lock
diff --git a/sources/Cargo.toml b/sources/Cargo.toml
@@ -63,6 +63,7 @@ members = [
     "settings-migrations/v1.56.0/image-verifier-plugins-extensible",
     "settings-migrations/v1.60.0/kubernetes-topology-manager-policy-options",
     "settings-migrations/v1.60.0/container-runtime-max-concurrent-unpacks",
+    "settings-migrations/v1.63.0/image-verifier-plugins-settings",
 
     "settings-plugins/aws-dev",
     "settings-plugins/aws-ecs-2",
diff --git a/sources/settings-defaults/aws-k8s-1.33-nvidia/defaults.d/58-image-verification.toml b/sources/settings-defaults/aws-k8s-1.33-nvidia/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/aws-k8s-1.33/defaults.d/58-image-verification.toml b/sources/settings-defaults/aws-k8s-1.33/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/aws-k8s-1.34-nvidia/defaults.d/58-image-verification.toml b/sources/settings-defaults/aws-k8s-1.34-nvidia/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/aws-k8s-1.34/defaults.d/58-image-verification.toml b/sources/settings-defaults/aws-k8s-1.34/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/aws-k8s-1.35-nvidia/defaults.d/58-image-verification.toml b/sources/settings-defaults/aws-k8s-1.35-nvidia/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/aws-k8s-1.35/defaults.d/58-image-verification.toml b/sources/settings-defaults/aws-k8s-1.35/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/aws-k8s-1.36-nvidia/defaults.d/58-image-verification.toml b/sources/settings-defaults/aws-k8s-1.36-nvidia/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/aws-k8s-1.36/defaults.d/58-image-verification.toml b/sources/settings-defaults/aws-k8s-1.36/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/vmware-k8s-1.33/defaults.d/58-image-verification.toml b/sources/settings-defaults/vmware-k8s-1.33/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/vmware-k8s-1.34/defaults.d/58-image-verification.toml b/sources/settings-defaults/vmware-k8s-1.34/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/vmware-k8s-1.35/defaults.d/58-image-verification.toml b/sources/settings-defaults/vmware-k8s-1.35/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-defaults/vmware-k8s-1.36/defaults.d/58-image-verification.toml b/sources/settings-defaults/vmware-k8s-1.36/defaults.d/58-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
diff --git a/sources/settings-migrations/v1.63.0/image-verifier-plugins-settings/Cargo.toml b/sources/settings-migrations/v1.63.0/image-verifier-plugins-settings/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "image-verifier-plugins-settings"
+version = "0.1.0"
+license = "Apache-2.0 OR MIT"
+edition = "2021"
+publish = false
+exclude = ["README.md"]
+
+[dependencies]
+migration-helpers.workspace = true
diff --git a/sources/settings-migrations/v1.63.0/image-verifier-plugins-settings/src/main.rs b/sources/settings-migrations/v1.63.0/image-verifier-plugins-settings/src/main.rs
@@ -0,0 +1,50 @@
+use migration_helpers::common_migrations::{AddPrefixesMigration, NoOpMigration};
+use migration_helpers::{migrate, MigrationData, Result};
+use std::process;
+
+/// Added new image-verifier-plugins settings.
+/// For k8s variants: remove the settings on downgrade since they didn't exist before.
+/// For ecs-3 variants: no migration needed since these settings already exist.
+fn run() -> Result<()> {
+    // Create a custom migration that checks variant at runtime
+    migrate(VariantSpecificMigration)
+}
+
+struct VariantSpecificMigration;
+
+impl migration_helpers::Migration for VariantSpecificMigration {
+    fn forward(&mut self, input: MigrationData) -> Result<MigrationData> {
+        // No work needed on upgrade for any variant
+        println!("VariantSpecificMigration has no work to do on upgrade.");
+        Ok(input)
+    }
+
+    fn backward(&mut self, input: MigrationData) -> Result<MigrationData> {
+        // Check variant from runtime data
+        if let Some(variant_value) = input.data.get("os.variant_id") {
+            if let Some(variant_str) = variant_value.as_str() {
+                if variant_str.starts_with("aws-ecs-") {
+                    // For ECS variants, no migration needed
+                    println!(
+                        "ECS variant detected ({}), no migration needed",
+                        variant_str
+                    );
+                    return NoOpMigration.backward(input);
+                }
+            }
+        }
+
+        println!("Using default behavior (remove settings on downgrade)");
+        AddPrefixesMigration(vec!["settings.image-verifier-plugins"]).backward(input)
+    }
+}
+
+// Returning a Result from main makes it print a Debug representation of the error, but with Snafu
+// we have nice Display representations of the error, so we wrap "main" (run) and print any error.
+// https://github.com/shepmaster/snafu/issues/110
+fn main() {
+    if let Err(e) = run() {
+        eprintln!("{e}");
+        process::exit(1);
+    }
+}
diff --git a/sources/settings-plugins/aws-k8s/src/lib.rs b/sources/settings-plugins/aws-k8s/src/lib.rs
@@ -24,5 +24,6 @@ struct AwsK8sSettings {
     dns: bottlerocket_settings_models::DnsSettingsV1,
     container_runtime: bottlerocket_settings_models::ContainerRuntimeSettingsV1,
     container_runtime_plugins: bottlerocket_settings_models::ContainerRuntimePluginsSettingsV1,
+    image_verifier_plugins: bottlerocket_settings_models::ImageVerifierPluginsSettingsV1,
     autoscaling: bottlerocket_settings_models::AutoScalingSettingsV1,
 }
diff --git a/sources/settings-plugins/vmware-k8s/src/lib.rs b/sources/settings-plugins/vmware-k8s/src/lib.rs
@@ -23,4 +23,5 @@ struct VmwareK8sSettings {
     dns: bottlerocket_settings_models::DnsSettingsV1,
     container_runtime: bottlerocket_settings_models::ContainerRuntimeSettingsV1,
     container_runtime_plugins: bottlerocket_settings_models::ContainerRuntimePluginsSettingsV1,
+    image_verifier_plugins: bottlerocket_settings_models::ImageVerifierPluginsSettingsV1,
 }
diff --git a/variants/aws-ecs-3-fips/Cargo.toml b/variants/aws-ecs-3-fips/Cargo.toml
@@ -33,7 +33,9 @@ included-packages = [
 # ecs
     "ecs-agent-config",
     "aws-signer-notation-plugin",
+    "digestion-image-verifier",
     "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-ecs-3-nvidia-fips/Cargo.toml b/variants/aws-ecs-3-nvidia-fips/Cargo.toml
@@ -34,7 +34,9 @@ included-packages = [
 # ecs
     "ecs-agent-nvidia-config",
     "aws-signer-notation-plugin",
+    "digestion-image-verifier",
     "notation-image-verifier",
+    "thar-be-image-verifiers",
 # NVIDIA support
     "ecs-gpu-init",
     "nvidia-container-toolkit-ecs",
diff --git a/variants/aws-ecs-3-nvidia/Cargo.toml b/variants/aws-ecs-3-nvidia/Cargo.toml
@@ -33,7 +33,9 @@ included-packages = [
 # ecs
     "ecs-agent-nvidia-config",
     "aws-signer-notation-plugin",
+    "digestion-image-verifier",
     "notation-image-verifier",
+    "thar-be-image-verifiers",
 # NVIDIA support
     "ecs-gpu-init",
     "nvidia-container-toolkit-ecs",
diff --git a/variants/aws-ecs-3/Cargo.toml b/variants/aws-ecs-3/Cargo.toml
@@ -32,7 +32,9 @@ included-packages = [
 # ecs
     "ecs-agent-config",
     "aws-signer-notation-plugin",
+    "digestion-image-verifier",
     "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-ecs-4-nvidia/Cargo.toml b/variants/aws-ecs-4-nvidia/Cargo.toml
@@ -33,7 +33,9 @@ included-packages = [
 # ecs
     "ecs-agent-nvidia-config",
     "aws-signer-notation-plugin",
+    "digestion-image-verifier",
     "notation-image-verifier",
+    "thar-be-image-verifiers",
 # NVIDIA support
     "ecs-gpu-init",
     "nvidia-container-toolkit-ecs",
diff --git a/variants/aws-ecs-4/Cargo.toml b/variants/aws-ecs-4/Cargo.toml
@@ -32,7 +32,9 @@ included-packages = [
 # ecs
     "ecs-agent-config",
     "aws-signer-notation-plugin",
+    "digestion-image-verifier",
     "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-k8s-1.33-fips/Cargo.toml b/variants/aws-k8s-1.33-fips/Cargo.toml
@@ -31,6 +31,10 @@ included-packages = [
     "kubelet-1.33",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-k8s-1.33-nvidia-fips/Cargo.toml b/variants/aws-k8s-1.33-nvidia-fips/Cargo.toml
@@ -34,6 +34,10 @@ included-packages = [
     "kubelet-1.33",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # nvidia
     "nvidia-container-toolkit-k8s",
     "nvidia-k8s-device-plugin",
diff --git a/variants/aws-k8s-1.33-nvidia/Cargo.toml b/variants/aws-k8s-1.33-nvidia/Cargo.toml
@@ -33,6 +33,10 @@ included-packages = [
     "kubelet-1.33",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # nvidia
     "nvidia-container-toolkit-k8s",
     "nvidia-k8s-device-plugin",
diff --git a/variants/aws-k8s-1.33/Cargo.toml b/variants/aws-k8s-1.33/Cargo.toml
@@ -30,6 +30,10 @@ included-packages = [
     "kubelet-1.33",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-k8s-1.34-fips/Cargo.toml b/variants/aws-k8s-1.34-fips/Cargo.toml
@@ -33,6 +33,10 @@ included-packages = [
     "kubelet-1.34",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-k8s-1.34-nvidia-fips/Cargo.toml b/variants/aws-k8s-1.34-nvidia-fips/Cargo.toml
@@ -36,6 +36,10 @@ included-packages = [
     "kubelet-1.34",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # nvidia
     "nvidia-container-toolkit-k8s",
     "nvidia-k8s-device-plugin",
diff --git a/variants/aws-k8s-1.34-nvidia/Cargo.toml b/variants/aws-k8s-1.34-nvidia/Cargo.toml
@@ -35,6 +35,10 @@ included-packages = [
     "kubelet-1.34",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # nvidia
     "nvidia-container-toolkit-k8s",
     "nvidia-k8s-device-plugin",
diff --git a/variants/aws-k8s-1.34/Cargo.toml b/variants/aws-k8s-1.34/Cargo.toml
@@ -32,6 +32,10 @@ included-packages = [
     "kubelet-1.34",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-k8s-1.35-fips/Cargo.toml b/variants/aws-k8s-1.35-fips/Cargo.toml
@@ -33,6 +33,10 @@ included-packages = [
     "kubelet-1.35",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-k8s-1.35-nvidia-fips/Cargo.toml b/variants/aws-k8s-1.35-nvidia-fips/Cargo.toml
@@ -36,6 +36,10 @@ included-packages = [
     "kubelet-1.35",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # nvidia
     "nvidia-container-toolkit-k8s",
     "nvidia-k8s-device-plugin",
diff --git a/variants/aws-k8s-1.35-nvidia/Cargo.toml b/variants/aws-k8s-1.35-nvidia/Cargo.toml
@@ -35,6 +35,10 @@ included-packages = [
     "kubelet-1.35",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # nvidia
     "nvidia-container-toolkit-k8s",
     "nvidia-k8s-device-plugin",
diff --git a/variants/aws-k8s-1.35/Cargo.toml b/variants/aws-k8s-1.35/Cargo.toml
@@ -32,6 +32,10 @@ included-packages = [
     "kubelet-1.35",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-k8s-1.36-fips/Cargo.toml b/variants/aws-k8s-1.36-fips/Cargo.toml
@@ -33,6 +33,10 @@ included-packages = [
     "kubelet-1.36",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/aws-k8s-1.36-nvidia-fips/Cargo.toml b/variants/aws-k8s-1.36-nvidia-fips/Cargo.toml
@@ -36,6 +36,10 @@ included-packages = [
     "kubelet-1.36",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # nvidia
     "nvidia-container-toolkit-k8s",
     "nvidia-k8s-device-plugin",
diff --git a/variants/aws-k8s-1.36-nvidia/Cargo.toml b/variants/aws-k8s-1.36-nvidia/Cargo.toml
@@ -35,6 +35,10 @@ included-packages = [
     "kubelet-1.36",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # nvidia
     "nvidia-container-toolkit-k8s",
     "nvidia-k8s-device-plugin",
diff --git a/variants/aws-k8s-1.36/Cargo.toml b/variants/aws-k8s-1.36/Cargo.toml
@@ -32,6 +32,10 @@ included-packages = [
     "kubelet-1.36",
     "aws-iam-authenticator",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
 ]
 kernel-parameters = [
     "console=tty0",
diff --git a/variants/vmware-k8s-1.33-fips/Cargo.toml b/variants/vmware-k8s-1.33-fips/Cargo.toml
@@ -43,6 +43,10 @@ included-packages = [
     "cni-plugins",
     "kubelet-1.33",
     "soci-snapshotter",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
     # vmware
     "open-vm-tools",
 ]
diff --git a/variants/vmware-k8s-1.33/Cargo.toml b/variants/vmware-k8s-1.33/Cargo.toml
diff --git a/variants/vmware-k8s-1.34-fips/Cargo.toml b/variants/vmware-k8s-1.34-fips/Cargo.toml
diff --git a/variants/vmware-k8s-1.34/Cargo.toml b/variants/vmware-k8s-1.34/Cargo.toml
diff --git a/variants/vmware-k8s-1.35-fips/Cargo.toml b/variants/vmware-k8s-1.35-fips/Cargo.toml
diff --git a/variants/vmware-k8s-1.35/Cargo.toml b/variants/vmware-k8s-1.35/Cargo.toml
diff --git a/variants/vmware-k8s-1.36-fips/Cargo.toml b/variants/vmware-k8s-1.36-fips/Cargo.toml
diff --git a/variants/vmware-k8s-1.36/Cargo.toml b/variants/vmware-k8s-1.36/Cargo.toml

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+../../../shared-defaults/image-verification.toml`