feat: verify prometheus-community charts (#2740)

* feat: verify prometheus-community charts

* add the key

Author: TylerHelmuth

Makefile

@@ -35,11 +35,14 @@ build: check-helm-version ## Build all charts
 
 ##@ Keys
 .PHONY: update-signing-keys
-update-signing-keys: keys/grafana-helm-charts-pubkey.gpg ## Refresh signing keys in keys/ from 1Password (requires the op CLI)
+update-signing-keys: keys/grafana-helm-charts-pubkey.gpg keys/prometheus-community-pubkey.gpg ## Refresh signing keys in keys/ (Grafana key requires the op CLI)
 
 keys/grafana-helm-charts-pubkey.gpg:
 	op --account grafana.1password.com read "op://Helm Maintainers/Helm Chart Signing Key/gpg-public-key.asc" | gpg --dearmor > keys/grafana-helm-charts-pubkey.gpg
 
+keys/prometheus-community-pubkey.gpg:
+	curl -sL https://prometheus-community.github.io/helm-charts/pubkey.gpg | gpg --dearmor > keys/prometheus-community-pubkey.gpg
+
 ##@ Install
 .PHONY: install
 install: ## Install dependencies

charts/k8s-monitoring/charts/telemetry-services/Makefile

@@ -8,7 +8,11 @@ endif
 HAS_HELM_UNITTEST := $(shell $(HELM) plugin list | grep unittest 2> /dev/null)
 
 K8S_MANIFEST_TAIL_VERSION := $(shell yq '.dependencies[] | select(.name == "k8s-manifest-tail") | .version' Chart.yaml)
+KUBE_STATE_METRICS_VERSION := $(shell yq '.dependencies[] | select(.name == "kube-state-metrics") | .version' Chart.yaml)
+NODE_EXPORTER_VERSION := $(shell yq '.dependencies[] | select(.name == "prometheus-node-exporter") | .version' Chart.yaml)
+WINDOWS_EXPORTER_VERSION := $(shell yq '.dependencies[] | select(.name == "prometheus-windows-exporter") | .version' Chart.yaml)
 GRAFANA_HELM_CHARTS_KEYRING := ../../../../keys/grafana-helm-charts-pubkey.gpg
+PROMETHEUS_COMMUNITY_KEYRING := ../../../../keys/prometheus-community-pubkey.gpg
 
 .SECONDEXPANSION:
 README.md: values.yaml Chart.yaml $$(wildcard README.md.gotmpl)
@@ -29,12 +33,27 @@ clean:
 build: README.md Chart.lock values.schema.json $(ALLOW_LISTS)
 
 .PHONY: verify-signatures
-verify-signatures: ## Verify the signature of the signed k8s-manifest-tail chart dependency
+verify-signatures: ## Verify the signatures of the signed chart dependencies
 	$(HELM) pull k8s-manifest-tail \
 		--repo https://grafana.github.io/helm-charts \
 		--version $(K8S_MANIFEST_TAIL_VERSION) \
 		--verify --keyring $(GRAFANA_HELM_CHARTS_KEYRING) \
 		--destination "$$(mktemp -d)"
+	$(HELM) pull kube-state-metrics \
+		--repo https://prometheus-community.github.io/helm-charts \
+		--version $(KUBE_STATE_METRICS_VERSION) \
+		--verify --keyring $(PROMETHEUS_COMMUNITY_KEYRING) \
+		--destination "$$(mktemp -d)"
+	$(HELM) pull prometheus-node-exporter \
+		--repo https://prometheus-community.github.io/helm-charts \
+		--version $(NODE_EXPORTER_VERSION) \
+		--verify --keyring $(PROMETHEUS_COMMUNITY_KEYRING) \
+		--destination "$$(mktemp -d)"
+	$(HELM) pull prometheus-windows-exporter \
+		--repo https://prometheus-community.github.io/helm-charts \
+		--version $(WINDOWS_EXPORTER_VERSION) \
+		--verify --keyring $(PROMETHEUS_COMMUNITY_KEYRING) \
+		--destination "$$(mktemp -d)"
 
 .PHONY: test
 test: build

keys/README.md

@@ -12,3 +12,15 @@ from `https://grafana.github.io/helm-charts`, such as `k8s-manifest-tail`,
 Key fingerprint `DDFB 6E2B E7ED 4FB1 1AA7 24C0 1D7C DC27 7F44 2050`. The key
 expires 2028-06-21. Confirm this fingerprint from a trusted, independent
 source before you replace the key.
+
+## prometheus-community-pubkey.gpg
+
+The "Prometheus Community Helm Charts" signing key. It verifies chart
+dependencies pulled from `https://prometheus-community.github.io/helm-charts`,
+such as `kube-state-metrics`, `prometheus-node-exporter`, and
+`prometheus-windows-exporter`.
+
+Published at <https://prometheus-community.github.io/helm-charts/pubkey.gpg>.
+Key fingerprint `E2F1 02EF A9AC D882 585B FE1A 2725 2B16 8248 743B`. The key
+does not expire. Confirm this fingerprint from a trusted, independent source
+before you replace the key.