[Help Needed] Migrate from python based connaisseur 3.0.0 to 3.8.4

[pbxqdown]

Greetings, we are updating from python-based connaisseur 3.0.0 to golang-based 3.8.4. Since it is a major upgrade for us, please let me know if there are config compatibility issues, behavior changes, performance improvements that needs to be considered. Your help is much appreciated. Thanks!

We relies on connaisseur to do image verification so latencies is critical to us.

[Starkteetje]

Hi @pbxqdown
the major change inbetween 3.0 and 3.8 is likely 3.4, which was when we made the switch from Python to Go

The major points can be taken from the announcement I linked, including our caching mechanism you already discovered. One issue, which we broke during that migration is that self-signed certificates no longer work (see #1640 or #1636). Unfortunately, we haven't had enough time to dedicate to fixing this so far.

Does that answer your question? If not, feel free to elaborate

[pbxqdown]

Hi @Starkteetje, thanks for your response!
We operate a comprehensive Kubernetes cluster and configure components directly rather than relying on helm install. This approach provides greater flexibility and enables tailored customization to meet our specific requirements. After updating config file mount path, alert and disable redis, I'm able to get connaisseur pod running. From the log it seems running fine.

Something I'm currently looking at:

• check if metrics is changing so dashboard needs tweak. I found that new image indeed has new metrics name(they are now prefixed with conaisseur_)
• log format is generally different, so our log query method may need to change as well.

Please let me know if there is anything else to concern. Some questions I have:

• I didn't update webhook config, but since in the connaisseur pod I can see images being verified normally, i think they should be good?
• I didn't change validator/policy config either. In the log no error is observed and image is verified correctly, so I guess for this part 3.8.4 is totally compatible with 3.0.0?

[burrmit]

Hi @pbxqdown the major change inbetween 3.0 and 3.8 is likely 3.4, which was when we made the switch from Python to Go

The major points can be taken from the announcement I linked, including our caching mechanism you already discovered. One issue, which we broke during that migration is that self-signed certificates no longer work (see #1640 or #1636). Unfortunately, we haven't had enough time to dedicate to fixing this so far.

Does that answer your question? If not, feel free to elaborate

I was able to resolve these issues now, for some reason within the template files, it appears that the application.validators[].cert field is essentially being ignored entirely within the helm template files since version 3.4 and I have been trying to resolve the issue for over a year.

I have finally got it fixed, but I had to rebuild my own custom image of the Connaisseur one, creating a 2 stage container image, first one was to import our internal CA and self-signed certificate, and then copy that over to the actual Connaissuer image (since the base Connaisseur image does no have the update-ca-certificates shell. Example Dockerfile used:

# Stage 1: Use a full-featured base to update CA certs
FROM python:3.13-slim AS certs
COPY internal-ca.crt /usr/local/share/ca-certificates/internal-ca.crt
RUN apt-get update && apt-get install -y ca-certificates && \
    update-ca-certificates

# Stage 2: Use the official Connaisseur image
FROM securesystemsengineering/connaisseur:v3.8.5
LABEL image.target=internal.registry.com/connaisseur
LABEL image.releasecandidate=TRUE

# Copy the updated CA bundle from the first stage
COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt