ECK operator images are not signed

[vijeyanidhi]

As per the steps in https://www.elastic.co/docs/deploy-manage/deploy/self-managed/install-elasticsearch-docker-basic the images from elastic can be verified using cosign to ensure there is no supply chain attacks.

but, eck operator images are not signed due to which verification can not be done.

[vijeyanidhi]

Image signing was disabled in this pr #8637 for some reason but it was never enabled back again.

https://github.com/elastic/cloud-on-k8s/blob/main/.buildkite/pipeline.yml#L78

[naemono]

I will take a look at this. there was an upstream issue causing us to disable signing which I believe has been resolved.

[vijeyanidhi]

@naemono ,
Thanks for getting the pr merged in.

Can i know when the images in https://www.docker.elastic.co/r/eck/eck-operator-ubi and https://www.docker.elastic.co/r/eck/eck-operator will have the image signatures.

Also will the images that are signed will be the ones with tag latest or even 3.0.0, 2.16.1, 2.16.0 will also be signed?

[naemono]

@vijeyanidhi 3.1.0 release will be the first to be signed, which is scheduled for release around the end of this month.

Closing as #8737 resolved this.

[barkbay]

I'm going to revert #8737 since images are currently not signed with the expected key. We need to make additional changes to our pipeline so that ECK images are signed with the same key as other stack applications.