--- title: Eliminating Kubernetes Image Signature Replication description: The Kubernetes image promoter pipeline has been simplified by eliminating the signature replication job that previously copied cosign signatures across 22... canonical: https://daily.dev/posts/eliminating-kubernetes-image-signature-replication-d9vrqlcjt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Eliminating Kubernetes Image Signature Replication | daily.dev og:description: The Kubernetes image promoter pipeline has been simplified by eliminating the signature replication job that previously copied cosign signatures across 22... og:url: https://daily.dev/posts/eliminating-kubernetes-image-signature-replication-d9vrqlcjt og:image: https://api.daily.dev/og/posts/D9vrqLCjt.png og:image:alt: Eliminating Kubernetes Image Signature Replication og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Eliminating Kubernetes Image Signature Replication **[K8S Contributors](https://daily.dev/sources/k8s_contrib)** · 4 min read · 4 upvotes · 0 comments ## Summary The Kubernetes image promoter pipeline has been simplified by eliminating the signature replication job that previously copied cosign signatures across 22 regional Google Artifact Registry backends. Instead of replicating every .sig and .att artifact to all regions, the archeio redirector was updated to route all signature manifest requests to a single canonical region (us-central1). This removes thousands of API calls every 2 hours, eliminates a source of transient failures from rate limiting, and deletes over 1,200 lines of replication code. The trade-off is a single-region dependency for cosign verify, which is considered acceptable given Google Cloud's regional availability guarantees. End users see no change in behavior. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Your container images are unsigned. In the AI era, that’s a ticking time bomb.](https://daily.dev/posts/your-container-images-are-unsigned-in-the-ai-era-that-s-a-ticking-time-bomb--cp7rfv8zj) · The New Stack · 0 upvotes · 0 comments - [Sign OCI containers & other artifacts using Sigstore Cosign & CircleCI OIDC tokens](https://daily.dev/posts/sign-oci-containers-other-artifacts-using-sigstore-cosign-circleci-oidc-tokens-dibffmehm) · CircleCI · 1 upvotes · 0 comments - [Container Image Security \(Signing and Scanning with tools like Cosign, Trivy\)](https://daily.dev/posts/container-image-security-signing-and-scanning-with-tools-like-cosign-trivy--rtw86fjgm) · InfoSec Write-ups · 0 upvotes · 0 comments - [Verify Cosign bring-your-own PKI signature on OpenShift](https://daily.dev/posts/verify-cosign-bring-your-own-pki-signature-on-openshift-wb3dblwif) · Red Hat Developer · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/eliminating-kubernetes-image-signature-replication-d9vrqlcjt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Eliminating Kubernetes Image Signature Replication","url":"https://daily.dev/posts/eliminating-kubernetes-image-signature-replication-d9vrqlcjt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/eliminating-kubernetes-image-signature-replication-d9vrqlcjt"},"datePublished":"2026-06-05T13:42:01.092Z","dateModified":"2026-06-07T17:44:51.565Z","description":"The Kubernetes image promoter pipeline has been simplified by eliminating the signature replication job that previously copied cosign signatures across 22...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"K8S Contributors","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"K8S Contributors","logo":"https://media.daily.dev/image/upload/s--QfYbdBSH--/f_auto/v1729364703/logos/k8s_contrib","url":"https://daily.dev/sources/k8s_contrib"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/eliminating-kubernetes-image-signature-replication-d9vrqlcjt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"K8S Contributors","item":"https://daily.dev/sources/k8s_contrib"},{"@type":"ListItem","position":3,"name":"Eliminating Kubernetes Image Signature Replication"}]} ```