Skip to content

RHDEVDOCS 6410 Chains automatic Cosign key pair #93507

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: pipelines-docs-main
Choose a base branch
from
Open

RHDEVDOCS 6410 Chains automatic Cosign key pair #93507

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 27 additions & 18 deletions ...les/op-chains-generating-x509-secret.adoc → ...s/op-chains-generating-cosign-secret.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,24 +2,10 @@
// * secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc

:_mod-docs-content-type: PROCEDURE
[id="chains-generating-x509-secret_{context}"]
= Generating the x509 key pair by using the TektonConfig CR
[id="chains-generating-cosign-secret_{context}"]
= Generating the cosign key pair by using the TektonConfig CR

To use the `x509` signing scheme for {tekton-chains} secrets, you must generate the `x509` key pair.

You can generate the `x509` key pair by setting the `generateSigningSecret` field in the `TektonConfig` custom resource (CR) to `true`.
The {pipelines-title} Operator generates an `ecdsa` type key pair: an `x509.pem` private key and an `x509-pub.pem` public key. The Operator stores the keys in the `signing-secrets` secret in the `openshift-pipelines` namespace.

[WARNING]
====
If you set the `generateSigningSecret` field from `true` to `false`, the {pipelines-title} Operator overrides and empties any value in the `signing-secrets` secret. Ensure that you store the `x509-pub.pem` public key outside of the secret to protect the key from the deletion. The Operator can use the key at a later stage to verify artifact attestations.
====

The {pipelines-title} Operator does not provide the following functions to limit potential security issues:

* Key rotation
* Auditing key usage
* Proper access control to the key
To use the `cosign` signing scheme for {tekton-chains} secrets, you can generate a `cosign` key pair that uses ECDSA encryption by setting the `generateSigningSecret` field in the `TektonConfig` custom resource (CR) to `true`.

.Prerequisites

Expand All @@ -37,7 +23,7 @@ $ oc edit TektonConfig config

. In the `TektonConfig` CR, set the `generateSigningSecret` value to `true`:
+
.Example of creating an ecdsa key pair by using the TektonConfig CR
.Example of creating an ECDSA cosign key pair by using the TektonConfig CR
[source,yaml]
----
apiVersion: operator.tekton.dev/v1
Expand All @@ -52,3 +38,26 @@ spec:
# ...
----
<1> The default value is `false`. Setting the value to `true` generates the `ecdsa` key pair.

.Result

The {pipelines-shortname} Operator generates an `ecdsa` type `cosign` key pair and stores it in the `signing-secrets` secret in the `openshift-pipelines` namespace. The secret includes the following files:

* `cosign.key`: The private key
* `cosign.password`: The password for decrypting the private key
* `cosign.pub` The public key

If a `signing-secrets` secret already exists, the Operator does not overwrite the secret.



[WARNING]
====
If you set the `generateSigningSecret` field from `true` to `false`, the {pipelines-title} Operator overrides and empties any value in the `signing-secrets` secret. Ensure that you store the `x509-pub.pem` public key outside of the secret to protect the key from the deletion. The Operator can use the key at a later stage to verify artifact attestations.
====

The {pipelines-title} Operator does not provide the following functions to limit potential security issues:

* Key rotation
* Auditing key usage
* Proper access control to the key
2 changes: 1 addition & 1 deletion modules/op-chains-signing-secrets-cosign.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
:_mod-docs-content-type: PROCEDURE

[id="chains-signing-secrets-cosign_{context}"]
= Signing with the cosign tool
= Manually generating signing secrets with the cosign tool

You can use the `cosign` signing scheme with {tekton-chains} using the `cosign` tool.

Expand Down
4 changes: 2 additions & 2 deletions modules/op-chains-signing-secrets-skopeo.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,13 @@
:_mod-docs-content-type: PROCEDURE

[id="chains-signing-secrets-skopeo_{context}"]
= Signing with the skopeo tool
= Manually generating signing secrets with the skopeo tool

You can generate keys using the `skopeo` tool and use them in the `cosign` signing scheme with {tekton-chains}.

.Prerequisites

* You installed the link:https://github.com/containers/skopeo[skopeo] tool.
* You installed the `skopeo` package on your Linux system.

.Procedure

Expand Down
2 changes: 1 addition & 1 deletion secure/using-tekton-chains-for-openshift-pipelines-supply-chain-security.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ include::modules/op-creating-mounting-kms-authentication-token-secret.adoc[level
include::modules/op-enabling-tekton-chains-to-operate-only-in-selected-namespaces.adoc[leveloffset=+2]

include::modules/op-signing-secrets-in-tekton-chains.adoc[leveloffset=+1]
include::modules/op-chains-generating-x509-secret.adoc[leveloffset=+2]
include::modules/op-chains-generating-cosign-secret.adoc[leveloffset=+2]
include::modules/op-chains-signing-secrets-cosign.adoc[leveloffset=+2]
include::modules/op-chains-signing-secrets-skopeo.adoc[leveloffset=+2]
include::modules/op-chains-resolving-existing-secret.adoc[leveloffset=+2]
Expand Down