End to end artifact trust in cloud environments
Techniques are described for providing end-to-end content trust for artifact types managed by a service provider, regardless of where or how the artifacts are deployed or applied in a target environment. The described trust mechanism is agnostic to the specific type of artifact and where the artifact is being applied from within a cloud environment.
1 . A method for managing trusted content in a computing network operated by a computing service provider, the method comprising:
receiving, by the computing service provider from a publisher, an artifact that is usable for deployments in the computing network;
determining that the artifact is associated with a resource type for an artifact store implemented at the computing service provider, wherein:
the artifact store holds artifacts under management of the computing service provider;
the service provider manages underlying registry and storage mechanisms for the artifacts; and
the artifact store requires publishers of artifacts to provide a valid signature for each artifact that the publishers declare and enter into the artifact store;
receiving, by the computing service provider from the publisher, a signature for the artifact, wherein the signature is based on a signing certificate obtained from a certificate authority;
verifying, by the computing service provider, the signature;
in response to verifying the signature, re-signing, by the computing service provider, the artifact with a certificate generated and managed by the computing service provider; and
using the re-signed artifact as a source of trust for the artifact for distribution and lifecycle of the artifact for the deployments in the computing network.
2 . The method of claim 1 , wherein the method is agnostic to a type of the artifact.
3 . The method of claim 2 , wherein the artifact is one of a container image, Helm package, Helm chart, configuration schema, templates, or virtual machine images.
4 . The method of claim 1 , further comprising providing immutability and versioning for the artifact.
5 . The method of claim 1 , further comprising revoking the artifact as a trusted artifact.
6 . The method of claim 1 , further comprising storing a plurality of re-signed artifacts in an artifact store.
7 . The method of claim 1 , wherein the verifying of the signature is based on a trust policy.
8 . A computing device comprising:
a memory storing thereon instructions that when executed by a processing system of the computing device, cause the computing device to perform operations comprising:
receiving, from a publisher, an artifact that is usable for deployments in a computing network;
determining that the artifact is associated with a resource type for an artifact store implemented at a computing service provider, wherein:
the artifact store holds artifacts under management of the computing service provider;
the service provider manages underlying registry and storage mechanisms for the artifacts; and
the artifact store requires publishers of artifacts to provide a valid signature for each artifact that the publishers declare and enter into the artifact store;
receiving, from the publisher, a signature for the artifact, wherein the signature is based on a signing certificate obtained from a certificate authority;
verifying the signature;
in response to verifying the signature, re-signing the artifact with a certificate generated and managed by a service provider; and
using the re-signed artifact as a source of trust for the artifact for distribution and lifecycle of the artifact for the deployments in the computing network.
9 . The computing device of claim 8 , wherein the operations are agnostic to a type of the artifact.
10 . The computing device of claim 9 , wherein the artifact is one of a container image, Helm package, Helm chart, configuration schema, templates, or virtual machine images.
11 . The computing device of claim 8 , further comprising instructions that when executed by a processing system of the computing device, cause the computing device to perform operations comprising providing immutability and versioning for the artifact.
12 . The computing device of claim 8 , further comprising instructions that when executed by a processing system of the computing device, cause the computing device to perform operations comprising revoking the artifact as a trusted artifact.
13 . The computing device of claim 8 , further comprising instructions that when executed by a processing system of the computing device, cause the computing device to perform operations comprising storing a plurality of re-signed artifacts in an artifact store.
14 . The computing device of claim 8 , wherein the verifying of the signature is based on a trust policy.
15 . A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by one or more processors of a system, cause the system to perform operations comprising:
receiving, from a publisher, an artifact that is usable for deployments in a computing network;
determining that the artifact is associated with a resource type for an artifact store implemented at a computing service provider, wherein:
the artifact store holds artifacts under management of the computing service provider;
the service provider manages underlying registry and storage mechanisms for the artifacts; and
the artifact store requires publishers of artifacts to provide a valid signature for each artifact that the publishers declare and enter into the artifact store;
receiving, from the publisher, a signature for the artifact, wherein the signature is based on a signing certificate obtained from a certificate authority;
verifying the signature;
in response to verifying the signature, re-signing the artifact with a certificate generated and managed by a service provider; and
using the re-signed artifact as a source of trust for the artifact for distribution and lifecycle of the artifact for the deployments in the computing network.
16 . The computer-readable storage medium of claim 15 , wherein the operations are agnostic to a type of the artifact.
17 . The computer-readable storage medium of claim 16 , wherein the artifact is one of a container image, Helm package, Helm chart, configuration schema, templates, or virtual machine images.
18 . The computer-readable storage medium of claim 15 , further comprising computer-executable instructions stored thereupon which, when executed by one or more processors of a system, cause the system to perform operations comprising providing immutability and versioning for the artifact.
19 . The computer-readable storage medium of claim 15 , further comprising computer-executable instructions stored thereupon which, when executed by one or more processors of a system, cause the system to perform operations comprising revoking the artifact as a trusted artifact.
20 . The computer-readable storage medium of claim 15 , further comprising computer-executable instructions stored thereupon which, when executed by one or more processors of a system, cause the system to perform operations comprising storing a plurality of re-signed artifacts in an artifact store.