Skip to main content

​
Overview

The Polystack Image Service security configuration covers three areas: image signature verification (preventing tampered images from being launched), property protections (preventing unauthorized modification of critical metadata fields), and public image access controls (restricting who can publish images to the global catalog).
Administrator Access Required — This operation requires the admin role. Contact your Polystack administrator if you do not have sufficient permissions.

​
Image Signing and Verification

Polystack Image Service supports image signature verification using certificates stored in Polystack Key Management. When enabled, the compute service verifies the image signature before launching an instance, preventing tampered images from being used.

Generate a signing key and certificate

Store the certificate in Polystack Key Management:
Create a certificate container in Key Management
Note the Secret href — this is the <CERT_UUID>.

Upload image with signature

Upload image with signature metadata

Enable verification in Compute

Configure the compute service to verify image signatures before launching:
Compute service: enable image signature verification
Deploy after configuring:
Apply compute configuration
The compute service now rejects instances launched from images with invalid or missing signatures when verification is enforced.
Enable signature verification enforcement via the compute service policy to ensure only signed images from your approved certificate authority can be launched.

​
Property Protections

Property protections prevent unauthorized users from modifying sensitive image properties — such as signature fields or hardware requirements — after upload.

Create the property protections configuration

/etc/ironcore/glance/property-protections.conf

Apply the configuration

Redeploy glance configuration
Property protections are active. Non-admin users cannot modify protected properties.

​
Public Image Access Controls

Only users with the admin role can mark images as public. Enforce this via policy to prevent accidental or malicious exposure of proprietary images organization-wide. Verify the policy is active:
Check publicize_image policy
If the policy needs tightening, add an override:
/etc/ironcore/glance/policy.yaml — restrict public image creation
Apply:
Apply policy override

​
Security Checklist

Signature verification enabled

Verify that image signature verification is enforced in the compute service policy. Test by attempting to launch an unsigned image — it should be rejected.
Confirm that signature-related properties (img_signature*) and platform properties (polystack_base_image, hw_firmware_type) require admin to modify.
Verify that non-admin users cannot set images to public visibility. Test with a project-member account: openstack image set --public <image-id> should return a policy violation error.
Regularly audit the public image catalog:
List all public images
Remove or deactivate any images that should not be publicly accessible.

​
Next Steps

Admin Troubleshooting

Diagnose signature verification failures and policy enforcement issues.

Quotas

Combine security controls with quota enforcement for complete image governance.

Identity Admin Guide

Manage the authentication policies governing image service access.

Metadata

Define structured property schemas that work with property protection rules.