# Eliminating Kubernetes Image Signature Replication

DevFeed: [Eliminating Kubernetes Image Signature Replication](<https://devfeed.tech/articles/eliminating-kubernetes-image-signature-replication-17597.md>)

Original publisher: [Read original article](<https://www.kubernetes.dev/blog/2026/06/05/image-signature-routing/>)

Author: The Kubernetes Authors

Published: 2026-06-05T00:00:00Z

Content type: article

Language: en

Sources: [Kubernetes Contributors Blog](<https://devfeed.tech/sources/kubernetes-contributors-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Replication](<https://devfeed.tech/topics/replication.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Routing (disambiguation)](<https://devfeed.tech/topics/routing.md>), [Latency](<https://devfeed.tech/topics/latency.md>), [Google](<https://devfeed.tech/topics/google.md>)

Tags: [cloud](<https://devfeed.tech/tags/cloud.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [cosign](<https://devfeed.tech/tags/cosign.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [latency](<https://devfeed.tech/tags/latency.md>), [manifest](<https://devfeed.tech/tags/manifest.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [registry](<https://devfeed.tech/tags/registry.md>), [replication](<https://devfeed.tech/tags/replication.md>), [route](<https://devfeed.tech/tags/route.md>), [routing](<https://devfeed.tech/tags/routing.md>), [sha256](<https://devfeed.tech/tags/sha256.md>), [signing](<https://devfeed.tech/tags/signing.md>), [verify](<https://devfeed.tech/tags/verify.md>)

## AI overview

This article explains how Kubernetes eliminated replication of image signatures across 22 regional registries. Because signatures are small and regional latency is negligible, archeio now routes signature requests to a canonical registry while image layers continue using geo-routing.

## Source excerpt

The image promoter rewrite laid the groundwork for simplifying how Kubernetes delivers container image signatures. One of the rewrite phases (Phase 6) separated image signing from signature replication into distinct pipeline stages. This follow-up covers the next step: eliminating signature replication entirely. The problem After promoting container images to registry.k8s.io, the promoter signs them using cosign with keyless (OIDC) signatures. These signatures are stored as OCI artifacts alongside the images, tagged with the convention sha256-<digest>.sig and sha256-<digest>.att. The registry.k8s.io domain is backed by archeio , a thin redirector that routes container image requests to the nearest regional Google Artifact Registry backend. When a user in Europe pulls an image, archeio redirects them to europe-west2-docker.pkg.dev; a user in Asia gets redirected to asia-east1-docker.pkg.dev, and so on across 22 regional backends. This geo-routing is great for image layers, where download locality matters for performance. But it created a problem for signatures: if the promoter only wrote a signature to one region, cosign verify would fail for users redirected to any other region. The solution was a dedicated replication pipeline that copied every .sig and .att tag to all 22 regional backends. This pipeline ran as a periodic Prow job every 2 hours on weekdays, performing thousands of API calls per run: listing tags across all repositories, diffing what existed where, and copying the missing signatures. The insight Signatures and attestations are small metadata artifacts, typically a few kilobytes each. Unlike image layers where geo-locality provides meaningful download performance improvements, fetching a signature from a non-local region adds negligible latency. The entire replication pipeline existed to optimize for a latency difference that users would never notice. The solution Instead of replicating signatures everywhere, archeio was taught to route signature req