search

sigstore / cosign

Code signing and transparency for containers and binaries
Apache License 2.0
4.44k stars 544 forks source link

Helm Plugin #1118

Open developer-guy opened 2 years ago

developer-guy commented 2 years ago

Description

There are very detailed guides about developing Helm plugins, so, AFAIK, this is all about providing a meta-data file called plugin.yaml.

We (w/@dentrax) thought that we can develop a helm plugin to allow signing all of the container images that are managed through the Helm Chart.

$ helm create my-chart

$ helm cosign sign --key (or keyless) my-chart
# we'll run the helm template command to get the whole manifest YAML file.
# we'll traverse the manifest YAML file, and extract the container images that we're going to sign
# sign them with cosign one by one.

WDYT?

References

evankanderson commented 1 year ago

Question: how do you identify all the images referenced in a Helm chart?

Separately, Helm currently supports OpenPGP-based provenance files. Would it make sense to specify a mechanism of signing Helm charts with cosign (particularly since they can be stored in OCI repositories)?

hectorj2f commented 1 year ago

@evankanderson We have https://github.com/sigstore/helm-sigstore. I think this is what you were looking.

evankanderson commented 1 year ago

Have we tried to add a link to helm-sigstore from the Helm docs yet? If not, I'm happy to send a PR.

hectorj2f commented 1 year ago

@evankanderson I don't know if we haven't done that to be honest.