Update DTR and image trust screenshots/workflows (#136)

* Update DTR and content trust screenshots and workflows

* Remove redirects
This commit is contained in:
Jim Galasyn 2017-07-13 14:42:46 -07:00
parent cdb5f5c923
commit a866583961
6 changed files with 17 additions and 20 deletions

View File

@ -1,7 +1,7 @@
---
description: Integrate UCP with Docker Trusted Registry
keywords: trusted, registry, integrate, UCP, DTR
title: Integrate with Docker Trusted Registry
description: Integrate UCP with Docker Trusted Registry
keywords: trust, registry, integrate, UCP, DTR
---
Once you deploy Docker Trusted Registry (DTR), you can use it to store your
@ -133,7 +133,7 @@ that are stored in DTR.
For each UCP node:
1. Log into the node as an administrator, using ssh
1. Log into the node as an administrator, using ssh.
2. Configure the system to trust the DTR TLS certificates, following the same
steps as you used to configure your local computer.

View File

@ -1,10 +1,7 @@
---
title: Run only the images you trust
description: Configure a Docker UCP cluster to only allow running applications that use images you trust.
keywords: docker, ucp, security, trust
redirect_from:
- /datacenter/ucp/2.1/guides/admin/configure/only-allow-running-signed-images/
- /datacenter/ucp/2.1/guides/admin/configure/use-trusted-images-for-ci/
description: Configure a Docker UCP swarm to only allow running applications that use images you trust.
keywords: ucp, dtr, security, trust
---
With Docker Universal Control Plane you can enforce applications to only use
@ -16,28 +13,28 @@ that is not trusted, and wont continue with the deployment if thats the ca
By signing and verifying the Docker images, you ensure that the images being
used in your cluster are the ones you trust and havent been altered either in
the image registry or on their way from the image registry to your UCP cluster.
the image registry or on their way from the image registry to your UCP swarm.
## Example workflow
Here's an example of a typical workflow:
1. A developer makes changes to a service and pushes their changes to a version
control system
control system.
2. A CI system creates a build, runs tests, and pushes an image to DTR with the
new changes
new changes.
3. The quality engineering team pulls the image and runs more tests. If
everything looks good they sign and push the image
everything looks good they sign and push the image.
4. The IT operations team deploys a service. If the image used for the service
was signed by the QA team, UCP deploys it. Otherwise UCP refuses to deploy.
was signed by the QA team, UCP deploys it. Otherwise UCP refuses to deploy.
## Configure UCP
To configure UCP to only allow running services that use Docker images you
trust, go to the **UCP web UI**, navigate to the **Settings** page, and click
the **Content Trust** tab.
trust, go to the UCP web UI, navigate to the **Admin Settings** page, and in
the left pane, click **Docker Content Trust**.
Select the **Run only signed images** option to only allow deploying
Select the **Run Only Signed Images** option to only allow deploying
applications if they use images you trust.
![UCP settings](../../images/run-only-the-images-you-trust-2.png){: .with-border}
@ -45,16 +42,16 @@ applications if they use images you trust.
With this setting, UCP allows deploying any image as long as the image has
been signed. It doesn't matter who signed the image.
To enforce that the image needs to be signed by specific teams, include those
teams in the **Require signature from** field.
To enforce that the image needs to be signed by specific teams, click the
dropdown and select those teams from the list.
![UCP settings](../../images/run-only-the-images-you-trust-3.png){: .with-border}
If you specify multiple teams, the image needs to be signed by a member of each
team, or someone that is a member of all those teams.
Click **Update** for UCP to start enforcing the policy.
Click **Save** for UCP to start enforcing the policy.
## Where to go next
* [Sign and push images to DTR](/datacenter/dtr/2.2/guides/user/manage-images/sign-images/index.md)
* [Sign and push images to DTR](/datacenter/dtr/2.3/guides/user/manage-images/sign-images/index.md)

Binary file not shown.

Before

Width:  |  Height:  |  Size: 107 KiB

After

Width:  |  Height:  |  Size: 84 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 95 KiB

After

Width:  |  Height:  |  Size: 83 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 202 KiB

After

Width:  |  Height:  |  Size: 56 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 212 KiB

After

Width:  |  Height:  |  Size: 57 KiB