examples.yaml

---
# Verify signed image using a public key without a fulcio issued certificate.
apiVersion: config.openshift.io/v1alpha1
kind: ImagePolicy
metadata:
  name: image-is-signed
spec:
  images:
    - hostname:5000/myns/sigstore-signed-with-full-references
  policy:
    keyData: Zm9vIGJhcg==
---
# Verify signed image with oidcIssuer and subjectEmail.
apiVersion: config.openshift.io/v1alpha1
kind: ImagePolicy
metadata:
  name: image-is-signed-fulcio
spec:
  images:
    - hostname:5000/myns/sigstore-signed-fulcio-rekor
  policy:
    oidcIssuer: https://github.com/login/oauth
    subjectEmail: test-user@example.com
---
# Verify signed image with remapped identity.
apiVersion: config.openshift.io/v1alpha1
kind: ImagePolicy
metadata:
  name: image-remap
spec:
  images:
    - hostname:5000/myns/sigstore-signed-fulcio-rekor
  policy:
    oidcIssuer: https://github.com/login/oauth
    subjectEmail: test-user@example.com
    signedIdentity:
      identityMatchPolicy: RemapIdentity
      prefix: private-mirror:5000/vendor-mirror
      signedPrefix: vendor.example.com