Update DTR and image trust screenshots/workflows (#136)
* Update DTR and content trust screenshots and workflows * Remove redirects
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
description: Integrate UCP with Docker Trusted Registry
|
||||
keywords: trusted, registry, integrate, UCP, DTR
|
||||
title: Integrate with Docker Trusted Registry
|
||||
description: Integrate UCP with Docker Trusted Registry
|
||||
keywords: trust, registry, integrate, UCP, DTR
|
||||
---
|
||||
|
||||
Once you deploy Docker Trusted Registry (DTR), you can use it to store your
|
||||
|
@ -133,7 +133,7 @@ that are stored in DTR.
|
|||
|
||||
For each UCP node:
|
||||
|
||||
1. Log into the node as an administrator, using ssh
|
||||
1. Log into the node as an administrator, using ssh.
|
||||
2. Configure the system to trust the DTR TLS certificates, following the same
|
||||
steps as you used to configure your local computer.
|
||||
|
||||
|
|
|
@ -1,10 +1,7 @@
|
|||
---
|
||||
title: Run only the images you trust
|
||||
description: Configure a Docker UCP cluster to only allow running applications that use images you trust.
|
||||
keywords: docker, ucp, security, trust
|
||||
redirect_from:
|
||||
- /datacenter/ucp/2.1/guides/admin/configure/only-allow-running-signed-images/
|
||||
- /datacenter/ucp/2.1/guides/admin/configure/use-trusted-images-for-ci/
|
||||
description: Configure a Docker UCP swarm to only allow running applications that use images you trust.
|
||||
keywords: ucp, dtr, security, trust
|
||||
---
|
||||
|
||||
With Docker Universal Control Plane you can enforce applications to only use
|
||||
|
@ -16,28 +13,28 @@ that is not trusted, and won’t continue with the deployment if that’s the ca
|
|||
|
||||
By signing and verifying the Docker images, you ensure that the images being
|
||||
used in your cluster are the ones you trust and haven’t been altered either in
|
||||
the image registry or on their way from the image registry to your UCP cluster.
|
||||
the image registry or on their way from the image registry to your UCP swarm.
|
||||
|
||||
## Example workflow
|
||||
|
||||
Here's an example of a typical workflow:
|
||||
|
||||
1. A developer makes changes to a service and pushes their changes to a version
|
||||
control system
|
||||
control system.
|
||||
2. A CI system creates a build, runs tests, and pushes an image to DTR with the
|
||||
new changes
|
||||
new changes.
|
||||
3. The quality engineering team pulls the image and runs more tests. If
|
||||
everything looks good they sign and push the image
|
||||
everything looks good they sign and push the image.
|
||||
4. The IT operations team deploys a service. If the image used for the service
|
||||
was signed by the QA team, UCP deploys it. Otherwise UCP refuses to deploy.
|
||||
was signed by the QA team, UCP deploys it. Otherwise UCP refuses to deploy.
|
||||
|
||||
## Configure UCP
|
||||
|
||||
To configure UCP to only allow running services that use Docker images you
|
||||
trust, go to the **UCP web UI**, navigate to the **Settings** page, and click
|
||||
the **Content Trust** tab.
|
||||
trust, go to the UCP web UI, navigate to the **Admin Settings** page, and in
|
||||
the left pane, click **Docker Content Trust**.
|
||||
|
||||
Select the **Run only signed images** option to only allow deploying
|
||||
Select the **Run Only Signed Images** option to only allow deploying
|
||||
applications if they use images you trust.
|
||||
|
||||
{: .with-border}
|
||||
|
@ -45,16 +42,16 @@ applications if they use images you trust.
|
|||
With this setting, UCP allows deploying any image as long as the image has
|
||||
been signed. It doesn't matter who signed the image.
|
||||
|
||||
To enforce that the image needs to be signed by specific teams, include those
|
||||
teams in the **Require signature from** field.
|
||||
To enforce that the image needs to be signed by specific teams, click the
|
||||
dropdown and select those teams from the list.
|
||||
|
||||
{: .with-border}
|
||||
|
||||
If you specify multiple teams, the image needs to be signed by a member of each
|
||||
team, or someone that is a member of all those teams.
|
||||
|
||||
Click **Update** for UCP to start enforcing the policy.
|
||||
Click **Save** for UCP to start enforcing the policy.
|
||||
|
||||
## Where to go next
|
||||
|
||||
* [Sign and push images to DTR](/datacenter/dtr/2.2/guides/user/manage-images/sign-images/index.md)
|
||||
* [Sign and push images to DTR](/datacenter/dtr/2.3/guides/user/manage-images/sign-images/index.md)
|
||||
|
|
Before Width: | Height: | Size: 107 KiB After Width: | Height: | Size: 84 KiB |
Before Width: | Height: | Size: 95 KiB After Width: | Height: | Size: 83 KiB |
Before Width: | Height: | Size: 202 KiB After Width: | Height: | Size: 56 KiB |
Before Width: | Height: | Size: 212 KiB After Width: | Height: | Size: 57 KiB |