Pushkar Joglekar
ba6776b2a6
* Add container image signing docs Signed-off-by: Sascha Grunert <sgrunert@redhat.com> * Creates a task page to verify signed control plane container images * Added info about cosigned and why we need cosign in experimental mode Updates based on PR review Apply suggestions from code review Co-authored-by: Tim Bannister <tim@scalefactory.com> * Uses K8s SBoM to get list of signed images Apply suggestions from code review Co-authored-by: Qiming Teng <tengqm@outlook.com> Co-authored-by: Chris Negus <cnegus@redhat.com> * Add current scope of sign/verify Co-authored-by: Sascha Grunert <sgrunert@redhat.com> Co-authored-by: Tim Bannister <tim@scalefactory.com> Co-authored-by: Qiming Teng <tengqm@outlook.com> Co-authored-by: Chris Negus <cnegus@redhat.com>
6.9 KiB
title, type
| title | type |
|---|---|
| Download Kubernetes | docs |
Core Kubernetes components
Kubernetes ships binaries for each component as well as a standard set of client applications to bootstrap or interact with a cluster. Components like the Kube API Server are capable of running within container images inside of a cluster. Those components are also shipped in container images as part of the official release process. All binaries as well as container images are available for multiple operating systems as well as hardware architectures.
Container Images
All Kubernetes container images are deployed to the k8s.gcr.io container registry.
{{< feature-state for_k8s_version="v1.24" state="alpha" >}}
From the beginning of Kubernetes {{< param "version" >}}, the following container images are signed using cosign signatures:
All container images are available for multiple architectures, whereas the
container runtime should choose the correct one based on the underlying
platform. It is also possible to pull a dedicated architecture by suffixing the
container image name, for example
k8s.gcr.io/kube-apiserver-arm64:{{< param "fullversion" >}}. All
those derivations are signed in the same way as the multi-architecture manifest lists.
The Kubernetes project publishes a list of signed Kubernetes container images in SBoM (Software Bill of Materials) format. You can fetch that list using:
curl -Ls https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/latest.txt)/release | grep 'PackageName: k8s.gcr.io/' | awk '{print $2}'
For Kubernetes v{{< skew currentVersion >}}, the only kind of code artifact that you can verify integrity for is a container image, using the experimental signing support.
To manually verify signed container images of Kubernetes core components, please refer to Verify Signed Container Images.
Binaries
Find links to download Kubernetes components (and their checksums) in the CHANGELOG files.
Alternately, use downloadkubernetes.com to filter by version and architecture.
kubectl
The Kubernetes command-line tool, kubectl, allows you to run commands against Kubernetes clusters.
You can use kubectl to deploy applications, inspect and manage cluster resources,
and view logs. For more information including a complete list of kubectl operations, see the
kubectl reference documentation.
kubectl is installable on a variety of Linux platforms, macOS and Windows. Find your preferred operating system below.