Supply-chain verification · OpenBao Operator

The controller resolves configured images to digests, verifies signatures against the selected trust policy, and uses the verified digest in managed workloads. Keep the OpenBao server and operator helper images as separate trust surfaces because they have different publishers and release identities.

Configure both trust surfaces

Configuration	Images covered
`spec.imageVerification`	OpenBao server images, including blue-green target images
`spec.operatorImageVerification`	Config init, backup, restore, and upgrade executor images

configure

Require both image policies

spec:
  imageVerification:
    enabled: true
    failurePolicy: Block
    issuer: https://token.actions.githubusercontent.com
    subject: "<expected OpenBao release workflow identity>"
  operatorImageVerification:
    enabled: true
    failurePolicy: Block
    issuer: https://token.actions.githubusercontent.com
    subject: "<expected operator release workflow identity>"

Use either a public key or a complete keyless issuer-and-subject pair. The operator supplies built-in keyless defaults only for recognized official repositories. A mirror, fork, or internal image needs explicit trust configuration even when it was copied from an official registry.

Hardened clusters enable both verification surfaces when the blocks are omitted and require Block. Custom public keys, issuer or subject matchers, regular-expression matchers, or ignoreTlog require useimagetrustroots on the cluster. Development permits Warn for staged adoption.

Understand failure behavior

Policy	Result
`Block`	Reconciliation stops for the affected workload and reports the verification failure
`Warn`	The error is logged and emitted as an Event; reconciliation continues with the original image reference

Successful verification produces a repo@sha256:... reference. Hardened managed StatefulSets and Jobs receive a digest-enforcement label, and admission rejects any container or init-container image that is not a SHA-256 digest. This provides defense in depth against controller bypass or an accidental tag reintroduction.

ignoreTlog: false is the default. Setting it to true skips transparency-log verification and changes the trust model; use it only as part of an explicit disconnected or private signing design.

Separate pull credentials

spec.imagePullSecrets is used by kubelets. The imagePullSecrets inside each verification block is used by the controller to resolve and verify a private image. In multi-tenant mode, the controller receives name-scoped get access only to the verification Secrets referenced in active tenant resources.

See Use private registries before promoting images into a disconnected environment.

Know what is not verified here

The in-cluster verifier does not verify the Helm chart, CRDs, operator installation image, GitHub Actions, or other release artifacts. Verify those in the installation and release process.

Custom blue-green validation-hook images are also not passed through operatorImageVerification. In a Hardened cluster, digest admission requires the hook image to be supplied as repo@sha256:...; the CR author also needs usecustomexecutables. A digest proves identity, not publisher trust, so validate that artifact before updating the cluster.

Artifact review

verify the publisher identity for both OpenBao and operator helper images
test verification against the actual registry or mirror and its authentication path
require Block and inspect rendered digest references for production workloads
validate custom hook and plugin artifacts outside the operator’s managed verification surfaces
retain chart, CRD, image-digest, signature, and provenance evidence with the deployed release