VerificationPolicy is at v1alpha1 stability level and subject to change.
Resource Definition
Standard Kubernetes metadata.
spec
VerificationPolicySpec
required
Specification of the verification policy.
VerificationPolicySpec
resources
[]ResourcePattern
required
Patterns defining which resources this policy applies to.Show ResourcePattern fields
Regex pattern to match resource sources.Examples:
https://github.com/tektoncd/catalog.githttps://github.com/tektoncd/*gcr.io/tekton-releases/catalog/upstream/*https://artifacthub.io/*
List of authorities (public keys) for validating signatures.
Public key reference for validation.
Inline public key data (PEM format).
Reference to a Secret containing the public key.Show SecretReference fields
KMS URL for the public key (not yet supported).Example format:gcpkms://projects/[PROJECT]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION]
Hash algorithm for signature verification.Supported values:
sha224sha256 (default)sha384sha512
How to handle verification failures.Values:
enforce - Fail the TaskRun/PipelineRun if verification fails (default)warn - Log warnings but don’t fail on verification failure
How Verification Works
- When a Task or Pipeline is fetched via remote resolution, Tekton checks for matching VerificationPolicies
- The resource URL is matched against the
resources patterns
- If a policy matches, the resource’s signature is verified using the specified authorities
- Verification uses the configured hash algorithm and public key
- Based on the
mode, verification failure either blocks execution or logs a warning
Tekton uses Sigstore/cosign compatible signatures. Resources should be signed using cosign or compatible tools.
Example: Verify GitHub Resources
apiVersion: tekton.dev/v1alpha1
kind: VerificationPolicy
metadata:
name: verify-tekton-catalog
spec:
resources:
- pattern: "https://github.com/tektoncd/catalog.git"
authorities:
- name: tekton-catalog-key
key:
data: |
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
-----END PUBLIC KEY-----
hashAlgorithm: sha256
mode: enforce
Example: Verify OCI Bundles
apiVersion: tekton.dev/v1alpha1
kind: VerificationPolicy
metadata:
name: verify-gcr-bundles
spec:
resources:
- pattern: "gcr.io/tekton-releases/catalog/upstream/*"
authorities:
- name: gcr-key
key:
secretRef:
name: cosign-pub-key
namespace: tekton-pipelines
mode: enforce
Example: Warn Mode
apiVersion: tekton.dev/v1alpha1
kind: VerificationPolicy
metadata:
name: verify-external-resources
spec:
resources:
- pattern: "https://github.com/external-org/*"
authorities:
- name: external-key
key:
data: |
-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
mode: warn