From 33528b073f69ee2132352954d252ee65d33ec4a3 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 24 Aug 2021 15:25:02 +0300 Subject: [PATCH 1/3] Add cosign keys Signed-off-by: Stefan Prodan --- cosign/cosign.key | 11 +++++++++++ cosign/cosign.pub | 4 ++++ 2 files changed, 15 insertions(+) create mode 100644 cosign/cosign.key create mode 100644 cosign/cosign.pub diff --git a/cosign/cosign.key b/cosign/cosign.key new file mode 100644 index 00000000..4e134588 --- /dev/null +++ b/cosign/cosign.key @@ -0,0 +1,11 @@ +-----BEGIN ENCRYPTED COSIGN PRIVATE KEY----- +eyJrZGYiOnsibmFtZSI6InNjcnlwdCIsInBhcmFtcyI6eyJOIjozMjc2OCwiciI6 +OCwicCI6MX0sInNhbHQiOiIvK1MwbTNrU3pGMFFXdVVYQkFoY2gvTDc3NVJBSy9O +cnkzUC9iMkxBZGF3PSJ9LCJjaXBoZXIiOnsibmFtZSI6Im5hY2wvc2VjcmV0Ym94 +Iiwibm9uY2UiOiJBNEFYL2IyU1BsMDBuY3JUNk45QkNOb0VLZTZLZEluRCJ9LCJj +aXBoZXJ0ZXh0IjoiZ054UlJweXpraWtRMUVaRldsSnEvQXVUWTl0Vis2enBlWkIy +dUFHREMzOVhUQlAwaWY5YStaZTE1V0NTT2FQZ01XQmtSZWhrQVVjQ3dZOGF2WTZa +eFhZWWE3T1B4eFdidHJuSUVZM2hwZUk1M1dVQVZ6SXEzQjl0N0ZmV1JlVGsxdFlo +b3hwQmxUSHY4U0c2azdPYk1aQnJleitzSGRWclF6YUdMdG12V1FOMTNZazRNb25i +ZUpRSUJpUXFQTFg5NzFhSUlxU0dxYVhCanc9PSJ9 +-----END ENCRYPTED COSIGN PRIVATE KEY----- diff --git a/cosign/cosign.pub b/cosign/cosign.pub new file mode 100644 index 00000000..5ce10489 --- /dev/null +++ b/cosign/cosign.pub @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEST+BqQ1XZhhVYx0YWQjdUJYIG5Lt +iz2+UxRIqmKBqNmce2T+l45qyqOs99qfD7gLNGmkVZ4vtJ9bM7FxChFczg== +-----END PUBLIC KEY----- From f0fa2aa6bbe31ed6a4902b4a418af4e2fa88bf27 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 24 Aug 2021 17:58:54 +0300 Subject: [PATCH 2/3] Sign Flagger container images with cosign Signed-off-by: Stefan Prodan --- .github/workflows/release.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3c88d307..c5dc1f8f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,6 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + - uses: sigstore/cosign-installer@main - name: Prepare id: prep run: | @@ -52,9 +53,18 @@ jobs: org.opencontainers.image.revision=${{ github.sha }} org.opencontainers.image.version=${{ steps.prep.outputs.VERSION }} org.opencontainers.image.created=${{ steps.prep.outputs.BUILD_DATE }} + - name: Sign image + run: | + echo -n "${{secrets.COSIGN_PASSWORD}}" | \ + cosign sign -key ./cosign/cosign.key -a git_sha=$GITHUB_SHA \ + ghcr.io/fluxcd/flagger:${{ steps.prep.outputs.VERSION }} - name: Check images run: | docker buildx imagetools inspect ghcr.io/fluxcd/flagger:${{ steps.prep.outputs.VERSION }} + - name: Verifiy image signature + run: | + cosign verify -key ./cosign/cosign.pub \ + ghcr.io/fluxcd/flagger:${{ steps.prep.outputs.VERSION }} - name: Publish Helm charts uses: stefanprodan/helm-gh-pages@v1.3.0 with: From 8b2839d36e8db0ea8c2b3ffde61cc52ce02f0ef8 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 24 Aug 2021 17:59:32 +0300 Subject: [PATCH 3/3] Add docs on how to verify Flagger containers with cosign Signed-off-by: Stefan Prodan --- cosign/README.md | 50 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 cosign/README.md diff --git a/cosign/README.md b/cosign/README.md new file mode 100644 index 00000000..a6f40845 --- /dev/null +++ b/cosign/README.md @@ -0,0 +1,50 @@ +# Flagger signed releases + +Flagger releases published to GitHub Container Registry as multi-arch container images +are signed using [cosign](https://github.com/sigstore/cosign). + +## Verify Flagger images + +Install the [cosign](https://github.com/sigstore/cosign) CLI: + +```sh +brew install sigstore/tap/cosign +``` + +Verify a Flagger release with cosign CLI: + +```sh +cosign verify -key https://raw.githubusercontent.com/fluxcd/flagger/main/cosign/cosign.pub \ +ghcr.io/fluxcd/flagger:1.13.0 +``` + +Verify Flagger images before they get pulled on your Kubernetes clusters with [Kyverno](https://github.com/kyverno/kyverno/): + +```yaml +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: verify-flagger-image + annotations: + policies.kyverno.io/title: Verify Flagger Image + policies.kyverno.io/category: Cosign + policies.kyverno.io/severity: medium + policies.kyverno.io/subject: Pod + policies.kyverno.io/minversion: 1.4.2 +spec: + validationFailureAction: enforce + background: false + rules: + - name: verify-image + match: + resources: + kinds: + - Pod + verifyImages: + - image: "ghcr.io/fluxcd/flagger:*" + key: |- + -----BEGIN PUBLIC KEY----- + MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEST+BqQ1XZhhVYx0YWQjdUJYIG5Lt + iz2+UxRIqmKBqNmce2T+l45qyqOs99qfD7gLNGmkVZ4vtJ9bM7FxChFczg== + -----END PUBLIC KEY----- +```