kritis-validation-hook-Container Service for Kubernetes(ACK)-阿里云帮助中心

kritis-validation-hook is a key add-on for verifying container image signatures when you deploy trusted containers. Use it to deploy only images signed by trusted authorized parties and reduce the risk of running unexpected or malicious code in your environment.

Add-on overview

Verifying image signatures before deployment ensures that only images signed by trusted authorized parties are deployed, reducing the risk of running unexpected or malicious code in your environment. For more information, see Introduction to kritis-validation-hook.

Usage

For instructions on how to use kritis-validation-hook, see Verify container image signatures with kritis-validation-hook.

Release notes

September 2025

Version	Image address	Release date	Changes	Impact
0.13.0	registry-cn-hangzhou.ack.aliyuncs.com/acs/kritis-server:0.13.0	September 11, 2025	Updates the naming convention for add-on versions. Upgrades the Golang version used by the add-on to 1.24.6 to improve stability.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

May 2025

Version	Image address	Release date	Changes	Impact
v0.12.0.0-g1535b25b-aliyun	registry-cn-hangzhou.ack.aliyuncs.com/acs/kritis-server:v0.12.0.0-g1535b25b-aliyun	May 7, 2025	Uses Security Hardening Mode to obtain instance metadata, starting with this version. For more information about Security Hardening Mode , see Instance metadata. Upgrades the Golang version used by the add-on to 1.24.3 to improve stability.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

August 2024

Version	Image address	Release date	Changes	Impact
v0.11.0.0-gf0617391-aliyun	registry-cn-hangzhou.ack.aliyuncs.com/acs/kritis-server:v0.11.0.0-gf0617391-aliyun	August 29, 2024	Adds support for configuring RAM Roles for Service Accounts (RRSA) authentication when you install or upgrade the add-on. Adds image signature verification when StatefulSet, Job, CronJob, and ReplicationController resources are created or updated.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

July 2024

Version	Image address	Release date	Changes	Impact
v0.10.0.0-gde6f9437-aliyun	registry-cn-hangzhou.ack.aliyuncs.com/acs/kritis-server:v0.10.0.0-gde6f9437-aliyun	July 4, 2024	Adds image signature verification for images used by ephemeral containers. Adds image signature verification when Deployment, DaemonSet, and ReplicaSet resources are created or updated.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

April 2023

Version	Image address	Release date	Changes	Impact
v0.9.0.0-gb7aa45c7-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.9.0.0-gb7aa45c7-aliyun	April 17, 2023	Supports Kubernetes 1.26.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

August 2022

Version	Image address	Release date	Changes	Impact
v0.8.0.4-g61d3531e-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.8.0.4-g61d3531e-aliyun	August 5, 2022	Improves image signature verification speed in large-scale clusters. Supports ACK Serverless clusters that run Kubernetes 1.22. Supports using the RRSA feature to configure the RAM permissions required by the add-on (an ACK Serverless cluster uses this method by default).	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

December 2021

Version	Image address	Release date	Changes	Impact
v0.6.0.5-gce1cc2d-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.6.0.5-gce1cc2d-aliyun	December 17, 2021	Supports Kubernetes 1.22. Starting with this version, the add-on supports only clusters that run Kubernetes 1.16 or later.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

November 2021

Version	Image address	Release date	Changes	Impact
v0.5.0.6-g525daee-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.5.0.6-g525daee-aliyun	November 15, 2021	Supports the image signature data format introduced by Container Registry (ACR). Supports the ARM64 architecture.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

June 2021

Version	Image address	Release date	Changes	Impact
v0.4.0.1-gb2862c4-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.4.0.1-gb2862c4-aliyun	June 10, 2021	Adds support for installing the kritis-validation-hook add-on in registered clusters.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

March 2021

Version	Image address	Release date	Changes	Impact
v0.3.1.4-ga89b624-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.3.1.4-ga89b624-aliyun	March 24, 2021	Supports image signature verification for images in repositories whose names contain forward slashes (/).	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

November 2020

Version	Image address	Release date	Changes	Impact
v0.2.7.2-g5fa671a-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.2.7.2-g5fa671a-aliyun	November 24, 2020	Adds an image signature verification whitelist. Images on the whitelist do not undergo signature verification. For more information, see Configure an image signature verification allowlist.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.
v0.2.6.4-g94b0940-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.2.6.4-g94b0940-aliyun	November 16, 2020	Supports image signature verification for images with the Container Service for Kubernetes (ACK) image version immutability feature enabled. For instructions, see Configure a repository to be immutable.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

August 2020

Version	Image address	Release date	Changes	Impact
v0.2.5.26-g75d5297-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.2.5.26-g75d5297-aliyun	August 12, 2020	By default, generates an event with the reason FailedKritisAdmission in the kube-system namespace when image signature verification fails. Adds a dry-run mode, which is disabled by default. When dry-run mode is enabled, requests that fail image signature verification are allowed, and an event with the reason DryRunKritisAdmission is generated in the kube-system namespace.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

June 2020

Version	Image address	Release date	Changes	Impact
v0.2.4.1-ge5c1265-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.2.4.1-ge5c1265-aliyun	June 22, 2020	Supports cross-region verification of signed ACR images.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

April 2020

Version	Image address	Release date	Changes	Impact
v0.2.3.1-00e70883-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.2.3.1-00e70883-aliyun	April 7, 2020	Improves application performance and log content.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.

March 2020

Version	Image address	Release date	Changes	Impact
v0.2.2.3-fe8a6319-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/kritis-server:v0.2.2.3-fe8a6319-aliyun	March 18, 2020	Integrates with ACR to support image signature verification for container images signed by Key Management Service (KMS), ensuring that only trusted container images are deployed in ACK.	An abnormal add-on upgrade may cause cluster resource changes to fail. If you need to upgrade the add-on, do so during off-peak hours.