diff --git a/scripts/azure-ci-test.sh b/scripts/azure-ci-test.sh index 8f1ca3561a..d14f882c42 100755 --- a/scripts/azure-ci-test.sh +++ b/scripts/azure-ci-test.sh @@ -135,7 +135,7 @@ trap cleanup EXIT main() { ./scripts/create-azure-resources.sh create_key_akv - + local ACR_USER_NAME="00000000-0000-0000-0000-000000000000" local ACR_PASSWORD=$(az acr login --name ${ACR_NAME} --expose-token --output tsv --query accessToken) make e2e-azure-setup TEST_REGISTRY=$REGISTRY TEST_REGISTRY_USERNAME=${ACR_USER_NAME} TEST_REGISTRY_PASSWORD=${ACR_PASSWORD} KEYVAULT_KEY_NAME=${KEYVAULT_KEY_NAME} KEYVAULT_NAME=${KEYVAULT_NAME} diff --git a/test/bats/azure-test.bats b/test/bats/azure-test.bats index 94a2d98a4c..89692e2d3b 100644 --- a/test/bats/azure-test.bats +++ b/test/bats/azure-test.bats @@ -58,7 +58,7 @@ SLEEP_TIME=1 assert_success run kubectl apply -f ./library/default/samples/constraint.yaml assert_success - + # verify that the image can be run with a root cert, root verification cert should have been configured on deployment run kubectl run demo-leaf --namespace default --image=${TEST_REGISTRY}/notation:leafSigned assert_success @@ -112,6 +112,9 @@ SLEEP_TIME=1 run kubectl apply -f ./library/default/samples/constraint.yaml assert_success sleep 5 + run kubectl apply -f ./test/bats/tests/config/config_v1beta1_verifier_cosign_akv.yaml + assert_success + sleep 5 run kubectl run cosign-demo --namespace default --image=${TEST_REGISTRY}/cosign:signed-key assert_success diff --git a/test/bats/tests/config/config_v1beta1_verifier_cosign_akv.yaml b/test/bats/tests/config/config_v1beta1_verifier_cosign_akv.yaml new file mode 100644 index 0000000000..fe1d9ef595 --- /dev/null +++ b/test/bats/tests/config/config_v1beta1_verifier_cosign_akv.yaml @@ -0,0 +1,18 @@ +apiVersion: config.ratify.deislabs.io/v1beta1 +kind: Verifier +metadata: + name: verifier-cosign + annotations: + helm.sh/hook: pre-install,pre-upgrade + helm.sh/hook-weight: "5" +spec: + name: cosign + artifactTypes: application/vnd.dev.cosign.artifact.sig.v1+json + parameters: + trustPolicies: + - name: default + version: 1.0.0 + scopes: + - "*" + keys: + - provider: gatekeeper-system/kmprovider-akv \ No newline at end of file