actions/fluxcd-flux2
3
0
Fork 0
mirror of https://github.com/fluxcd/flux2.git synced 2026-02-18 21:51:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Merge pull request #3154 from fluxcd/rfc-0003-cosign

Browse source 
[RFC-0003] Add Cosign keyless specification
This commit is contained in:
Stefan Prodan 2022-09-29 09:42:20 +03:00 committed by GitHub
commit 33a874800b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 29 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
rfcs/0003-kubernetes-oci/README.md
View file

@ -4,7 +4,7 @@
**Creation date:** 2022-03-31 **Creation date:** 2022-03-31
**Last update:** 2022-08-22 **Last update:** 2022-09-28
## Summary ## Summary
@ -124,16 +124,6 @@ spec:
semver: "6.0.x" semver: "6.0.x"
``` ```
To verify the authenticity of an artifact, the Sigstore cosign public key can be supplied with:
```yaml
spec:
verify:
provider: cosign
secretRef:
name: cosign-key
```
### Layer selection ### Layer selection
By default, Flux assumes that the first layer of the OCI artifact contains the Kubernetes configuration. By default, Flux assumes that the first layer of the OCI artifact contains the Kubernetes configuration.
@ -224,6 +214,34 @@ controller will use a specific cloud SDK for authentication purposes. If both `s
a non-generic provider are present in the definition, the controller will use the static credentials a non-generic provider are present in the definition, the controller will use the static credentials
from the referenced secret. from the referenced secret.
### Verify artifacts
To verify the authenticity of the OCI artifacts, Flux will use the Sigstore Go SDK and implement verification
for artifacts which were either signed with keys generated by Cosign or signed using the Cosign
[keyless method](https://github.com/sigstore/cosign/blob/main/KEYLESS.md).
To enable signature verification, the Cosign public key can be supplied with:
```yaml
spec:
verify:
provider: cosign
secretRef:
name: cosign-key
```
For verifying public artifacts which are signed using the keyless method,
the `spec.verify.secretRef` field must be omitted:
```yaml
spec:
verify:
provider: cosign
```
When using the keyless method, Flux will verify the signatures in the Rekor
transparency log instance hosted at [rekor.sigstore.dev](https://rekor.sigstore.dev/).
### Reconcile artifacts ### Reconcile artifacts
The `OCIRepository` can be used as a drop-in replacement for `GitRepository` and `Bucket` sources. The `OCIRepository` can be used as a drop-in replacement for `GitRepository` and `Bucket` sources.