Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / How Cloud Bills Now Charge for Container Image Signing
Transcript
- Lucas: So, we've talked a lot on this show about the nickel and diming that shows up on cloud invoices. Data egress, DNS queries, API calls. But there's a new line item that's starting to appear on enterprise bills, and it's one that's got a lot of infrastructure teams scratching their heads. Luna: What is it this time? Let me guess — they're charging for the air in the data center? Lucas: Close, but not quite. It's container image signing. You know, that cryptographic stamp of approval that says this image came from your trusted build pipeline and hasn't been tampered with. For years, it was free. Now, the major cloud providers are metering signature verification requests, and if you're running Kubernetes at scale, this can add real money to your monthly bill. Luna: So they're charging for something that's supposed to make our supply chains more secure? That feels like a tax on doing the right thing. Lucas: Exactly the tension. And it's worth unpacking how we got here. Container signing really came into the mainstream after the SolarWinds and log4j attacks — suddenly everyone wanted to know that the code running in their clusters was actually what their developers wrote. Tools like Sigstore and cosign made it easy to sign images and verify them at pull time. But easy and free is not a business model. Luna: Right. So what triggered the metering? Was it the providers, or did the tools start charging first? Lucas: Good question. It's a mix. The open-source signing tools themselves remain free. But when you're using the managed registries — think AWS Elastic Container Registry, Azure Container Registry, Google Artifact Registry — the verification step now incurs a cost. The providers frame it as 'signature validation requests' in their price sheets. You're paying for the compute that confirms the signature is valid, essentially. Luna: So every time a pod pulls an image and the kubelet checks the signature, that's a billable event. How much are we talking per request? Lucas: It's tiny per request — we're talking fractions of a cent. But here's where it sneaks up on you. If you have a large cluster with hundreds of nodes, and you're rolling out new deployments several times a day, the number of verification events can explode. And the providers have tiered pricing, so the more you verify, the higher the per-request rate. Luna: That's a classic cloud move. Make the unit price so low that nobody notices, then scale it up. Lucas: Precisely. And I've got a concrete case. A fintech company I spoke with — they run their core payment processing on Kubernetes — enabled mandatory signature verification across all their namespaces. They're doing about forty thousand image pulls a day, which sounds like a lot, but it's really not for a company processing that volume. Their cloud bill jumped by eight percent in the first month. That's not a rounding error. Luna: Eight percent just on image signing? That's huge. What were they paying before, and what did it become? Lucas: They were spending around sixty thousand a month on their overall cloud infrastructure, so eight percent is roughly five grand. And that's only the verification side. They also had to pay for the signing itself — they use a managed key service, and each signing operation has its own cost. The combination took them from negligible to a noticeable line item on the invoice. Luna: So what do you tell teams who are looking at this and wondering if they should just skip signing to save money? Lucas: That's the dangerous path. I mean, we've seen the cost of a supply chain breach, and it's not just financial — it's trust. But the point isn't to avoid signing; it's to understand where the costs are and optimize. For example, you can choose to verify only on critical workloads, or you can cache verification results for a short window so you're not re-checking the same image digest every single pull. Luna: Caching verification results — is that actually safe? Doesn't that defeat the purpose of checking every pull? Lucas: It's a trade-off. The signature doesn't change for a given image digest, so if you've already verified it once, re-checking is somewhat redundant. But the risk is that if the image is mutable — say the tag points to a new digest — you might miss that. In practice, teams that use immutable tags, which is best practice anyway, can safely cache for a few minutes without much additional risk. Luna: Okay, so it's about smart caching, not abandoning security. But what about the vendors — are they being transparent about these costs, or is it hidden in the fine print? Lucas: That's actually the part that bugs me. The pricing pages do list 'signature verification' as a line item now, but it's buried under 'registry operations' or 'container services.' You have to dig into the detailed pricing breakdown to even see it. And the default is often to have verification enabled at the registry level, so you might be paying without knowing it until the invoice arrives. Luna: So the default is on. That feels like a classic dark pattern. How do you even know if you're being charged for this right now? Lucas: Great question. The first step is to check your cloud provider's billing dashboard and look for any new line items related to container registry or artifact services. If you see 'signature validation' or 'attestation verification,' that's it. You can also look at your usage reports to see how many verification requests you're generating per day. That's the baseline. Luna: And then what? Do you have any advice for negotiating with the provider or pushing back? Lucas: Well, some teams have had success asking for a waiver or a discount by pointing out that they're on a long-term contract. But not everyone has that leverage. The more practical angle is to look at your own architecture. Are you verifying at the registry level and again at the cluster level? You might be double-paying for the same verification. Consolidating that can cut your costs significantly. Luna: Double verification — that's a good catch. So the real bill might be twice what you think if you have both layers enabled. Lucas: Exactly. And that's the kind of thing a standard invoice audit won't catch unless you know to look for it. We've covered a lot of these hidden costs on the show, and this is shaping up to be one of the sneakiest, because it's tied to a security best practice that nobody wants to disable. Luna: Right. It's like they're charging us for wearing seatbelts. You can't argue with safety, but the meter's running. Lucas: Exactly. And that's the thing — the providers know that you can't easily say no to signing. It's become table stakes for security audits and compliance frameworks. So they've found a revenue stream that's almost inelastic. But being aware of it, and optimizing how you implement it, can keep the cost from spiraling. Luna: So, for our listeners who run Kubernetes, what's the one concrete takeaway you want them to remember? Lucas: Check your latest invoice for any line item that says 'signature verification' or 'attestation.' Just knowing whether you're being charged is the first step. If you are, look at your verification rate and consider whether you can cache results or verify only on critical paths. It's not about dodging security — it's about making sure you're not overpaying for it. Luna: That's practical. And on that note, I think we've given everyone a lot to chew on. Before we wrap, Lucas, I know we get a lot of messages from listeners who say these episodes help them spot exactly these kinds of costs. Lucas: Yeah, that's the best part of doing this. And it's also why we keep the show ad-free. It's a small operation, just the two of us, and it's the listener support that really keeps it going. If you've gotten something out of these conversations, a couple of dollars a month genuinely makes a difference. You can find that at buy me a coffee dot com slash fexingo. Luna: And it's not about the amount — every little bit helps us keep digging into these obscure corners of cloud billing. Lucas: Right. So, to wrap up the actual topic: the next time you're reviewing your cloud bill, don't just look at the big-ticket items like compute and storage. Drill into the registry and security services. The image signing line might be small, but it's a new line that wasn't there a year ago, and it's only going to grow as more teams adopt signing for compliance. Luna: And if you're using one of the major clouds, you can bet this is on the roadmap for the others if it's not already. It's a natural extension of the metering trend. Lucas: Exactly. So keep an eye on it. And if you find a line item that surprises you, drop us a note — we love hearing about the weird charges you're finding. It might just become the next episode.