Skip to content

Commit f6a9afa

Browse files
cmurphycmurphy
authored
Add ctlog-tiles chart (#1098)
Add a chart named ctlog-tiles to support TesseraCT as an alternative CT log for Fulcio. The POSIX and GCP backends are supported. This chart has a unique way of crafting the image string based on which personality (posix or gcp) is chosen. This lets values.yaml/Chart.yaml still be the source of truth for the image version, which is consistent with how Sigstore charts are used in the public good instance (as opposed to overriding the image version in the infrastructure values.yaml). This is closely based on the rekor-tiles chart. It creates NEGs but no explicit Ingress gateway, since a multi-purpose load balancer needs to be created externally to link the service to the backend bucket. Signed-off-by: Colleen Murphy <[email protected]>
1 parent 2776d88 commit f6a9afa

File tree

13 files changed

+1153
-0
lines changed

13 files changed

+1153
-0
lines changed

‎charts/ctlog-tiles/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/ctlog-tiles/Chart.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: v2
2+
name: ctlog-tiles
3+
description: Tiles-based certificate log (TesseraCT)
4+
type: application
5+
version: 0.1.0
6+
appVersion: v0.1.1
7+
keywords:
8+
- security
9+
- certificate transparency
10+
home: https://sigstore.dev
11+
sources:
12+
- https://github.com/transparency-dev/tesseract
13+
maintainers:
14+
- name: The Sigstore Authors
15+
annotations:
16+
artifacthub.io/license: Apache-2.0
17+
artifacthub.io/images: |
18+
- name: tesseract-posix
19+
image: ghcr.io/sigstore/scaffolding/tesseract/posix:v0.1.1@sha256:767c2dbe4a83be9243246564244aa381322f08f2a864371f62b880c465033815
20+
- name: tesseract-gcp
21+
image: ghcr.io/sigstore/scaffolding/tesseract/gcp:v0.1.1@sha256:17d3788b736de01ab0586359626c01789910a6e2981e7b90014fbda8689f5017

‎charts/ctlog-tiles/README.md‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
# ctlog-tiles
2+
3+
<!-- This README.md is generated. Please edit README.md.gotmpl -->
4+
5+
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.1.1](https://img.shields.io/badge/AppVersion-v0.1.1-informational?style=flat-square)
6+
7+
Tiles-based certificate log (TesseraCT)
8+
9+
**Homepage:** <https://sigstore.dev>
10+
11+
## Quick Installation
12+
13+
To install the helm chart with default values run following command.
14+
The [Values](#values) section describes the configuration options for this chart.
15+
16+
```shell
17+
helm dependency update .
18+
helm install [RELEASE_NAME] .
19+
```
20+
21+
## Uninstallation
22+
23+
To uninstall the Helm chart run following command.
24+
25+
```shell
26+
helm uninstall [RELEASE_NAME]
27+
```
28+
29+
## Specifying Fulcio roots
30+
31+
Unlike the ctlog chart, there is no createctconfig job that runs and fetches Fulcio's roots from the rootCert endpoint. The roots need to be known ahead of time and specified directly in values.yaml:
32+
33+
```
34+
server:
35+
...
36+
fulcio:
37+
rootPEM: |-
38+
-----BEGIN CERTIFICATE-----
39+
...
40+
```
41+
42+
## Using the POSIX backend
43+
44+
In values.yaml, set `image.flavor` to `"posix"` (default).
45+
46+
Create a secret for the private key:
47+
48+
```
49+
openssl ecparam -name prime256v1 -genkey -noout -out /path/to/privkey.pem
50+
kubectl -n ctlog-tiles-system create secret generic ctlog-signing-key --from-file=signing-key=/path/to/privkey.pem
51+
```
52+
53+
Encrypted secret keys are not supported.
54+
55+
Configure the private key and storage directory in values.yaml:
56+
57+
```
58+
server:
59+
...
60+
posix:
61+
privateKey:
62+
path: /etc/ctfe/signer.pem
63+
secret:
64+
name: signing-key
65+
key: signing-key
66+
mountPath: /etc/ctfe
67+
mountSubPath: signer.pem
68+
storageDir:
69+
path: /storage
70+
name: ctlog
71+
volume:
72+
hostPath:
73+
path: /data/ctlog-storage
74+
type: Directory
75+
```
76+
77+
## Using the GCP backend
78+
79+
The deployment needs to be running in a GKE cluster with workload identity
80+
enabled and with permission to access secrets, storage objects, and Spanner
81+
databases.
82+
83+
In values.yaml, set `image.flavor` to `"gcp"`.
84+
85+
Create a Spanner instance and database in GCP:
86+
87+
```
88+
gcloud spanner instances create tesseract \
89+
--config=regional-us-west1 \
90+
--description="test" --nodes=1
91+
gcloud spanner databases create sequencer --instance tesseract
92+
# If using antispam, create the antispam database too:
93+
# gcloud spanner databases create antispam --instance tesseract
94+
```
95+
96+
Create a GCS bucket:
97+
98+
```
99+
gcloud storage buckets create gs://unique-tesseract-bucket-name
100+
```
101+
102+
Create secrets in Secret Manager for both the private and public keys:
103+
104+
```
105+
gcloud secrets create tesseract-private --data-file=/path/to/privkey.pem
106+
gcloud secrets create tesseract-public --data-file=/path/to/pubkey.pem
107+
```
108+
109+
Configure the Spanner path, bucket, and signer keys in values.yaml:
110+
111+
```
112+
server:
113+
...
114+
gcp:
115+
spanner: projects/my-project/instances/tesseract/databases/sequencer
116+
bucket: unique-tesseract-bucket-name
117+
signer:
118+
privateKey: projects/1234/secrets/tesseract-private/versions/1
119+
publicKey: projects/1234/secrets/tesseract-public/versions/1
120+
```
121+
122+
## Maintainers
123+
124+
| Name | Email | Url |
125+
| ---- | ------ | --- |
126+
| The Sigstore Authors | | |
127+
128+
## Source Code
129+
130+
* <https://github.com/transparency-dev/tesseract>
131+
132+
## Values
133+
134+
| Key | Type | Default | Description |
135+
|-----|------|---------|-------------|
136+
| affinity | object | `{}` | |
137+
| fullnameOverride | string | `""` | |
138+
| image.flavor | string | `"posix"` | |
139+
| image.gcpSHA | string | `"sha256:17d3788b736de01ab0586359626c01789910a6e2981e7b90014fbda8689f5017"` | |
140+
| image.posixSHA | string | `"sha256:767c2dbe4a83be9243246564244aa381322f08f2a864371f62b880c465033815"` | |
141+
| image.pullPolicy | string | `"IfNotPresent"` | |
142+
| image.registry | string | `"ghcr.io"` | |
143+
| image.repository | string | `"sigstore/scaffolding/tesseract"` | |
144+
| image.version | string | `"v0.1.1"` | |
145+
| imagePullSecrets | list | `[]` | |
146+
| lifecycle.preStop.exec.command[0] | string | `"sleep"` | |
147+
| lifecycle.preStop.exec.command[1] | string | `"15"` | |
148+
| livenessProbe.httpGet.path | string | `"/healthz"` | |
149+
| livenessProbe.httpGet.port | int | `6962` | |
150+
| nameOverride | string | `""` | |
151+
| namespace.create | bool | `false` | |
152+
| namespace.name | string | `"ctlog-tiles-system"` | |
153+
| neg.http.name | string | `""` | |
154+
| neg.http.port | int | `80` | |
155+
| nodeSelector."iam.gke.io/gke-metadata-server-enabled" | string | `"true"` | |
156+
| podAnnotations | object | `{}` | |
157+
| podLabels | object | `{}` | |
158+
| podSecurityContext | object | `{}` | |
159+
| readinessProbe.httpGet.path | string | `"/healthz"` | |
160+
| readinessProbe.httpGet.port | int | `6962` | |
161+
| replicaCount | int | `1` | |
162+
| resources | object | `{}` | |
163+
| securityContext.allowPrivilegeEscalation | bool | `false` | |
164+
| securityContext.capabilities.drop[0] | string | `"ALL"` | |
165+
| securityContext.readOnlyRootFilesystem | bool | `true` | |
166+
| securityContext.runAsNonRoot | bool | `true` | |
167+
| securityContext.runAsUser | int | `65533` | |
168+
| server.antispam | object | `{}` | |
169+
| server.extraArgs | list | `[]` | |
170+
| server.fulcio.configMap.key | string | `"fulcio"` | |
171+
| server.fulcio.configMap.mountPath | string | `"/etc/fulcio"` | |
172+
| server.fulcio.configMap.mountSubPath | string | `"roots.pem"` | |
173+
| server.fulcio.configMap.name | string | `"fulcio-roots"` | |
174+
| server.fulcio.path | string | `"/etc/fulcio/roots.pem"` | |
175+
| server.fulcio.rootPEM | string | `""` | |
176+
| server.gcp | object | `{}` | |
177+
| server.hostname | string | `"localhost"` | |
178+
| server.http.port | string | `"6962"` | |
179+
| server.logLevel | string | `"1"` | |
180+
| server.posix | object | `{}` | |
181+
| server.serverConfig | object | `{}` | |
182+
| server.tesseraLivecycle | object | `{}` | |
183+
| server.witnessing | object | `{}` | |
184+
| service.ports[0].name | string | `"6962-tcp"` | |
185+
| service.ports[0].port | int | `80` | |
186+
| service.ports[0].protocol | string | `"TCP"` | |
187+
| service.ports[0].targetPort | int | `6962` | |
188+
| service.type | string | `"ClusterIP"` | |
189+
| serviceAccount.annotations | object | `{}` | |
190+
| serviceAccount.automount | bool | `true` | |
191+
| serviceAccount.create | bool | `true` | |
192+
| serviceAccount.name | string | `""` | |
193+
| terminationGracePeriodSeconds | int | `65` | |
194+
| tolerations | list | `[]` | |

‎charts/ctlog-tiles/README.md.gotmpl‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
{{ template "chart.header" . }}
2+
3+
<!-- This README.md is generated. Please edit README.md.gotmpl -->
4+
5+
{{ template "chart.deprecationWarning" . }}
6+
7+
{{ template "chart.badgesSection" . }}
8+
9+
{{ template "chart.description" . }}
10+
11+
{{ template "chart.homepageLine" . }}
12+
13+
## Quick Installation
14+
15+
To install the helm chart with default values run following command.
16+
The [Values](#values) section describes the configuration options for this chart.
17+
18+
```shell
19+
helm dependency update .
20+
helm install [RELEASE_NAME] .
21+
```
22+
23+
## Uninstallation
24+
25+
To uninstall the Helm chart run following command.
26+
27+
```shell
28+
helm uninstall [RELEASE_NAME]
29+
```
30+
31+
## Specifying Fulcio roots
32+
33+
Unlike the ctlog chart, there is no createctconfig job that runs and fetches Fulcio's roots from the rootCert endpoint. The roots need to be known ahead of time and specified directly in values.yaml:
34+
35+
```
36+
server:
37+
...
38+
fulcio:
39+
rootPEM: |-
40+
-----BEGIN CERTIFICATE-----
41+
...
42+
```
43+
44+
## Using the POSIX backend
45+
46+
In values.yaml, set `image.flavor` to `"posix"` (default).
47+
48+
Create a secret for the private key:
49+
50+
```
51+
openssl ecparam -name prime256v1 -genkey -noout -out /path/to/privkey.pem
52+
kubectl -n ctlog-tiles-system create secret generic ctlog-signing-key --from-file=signing-key=/path/to/privkey.pem
53+
```
54+
55+
Encrypted secret keys are not supported.
56+
57+
Configure the private key and storage directory in values.yaml:
58+
59+
```
60+
server:
61+
...
62+
posix:
63+
privateKey:
64+
path: /etc/ctfe/signer.pem
65+
secret:
66+
name: signing-key
67+
key: signing-key
68+
mountPath: /etc/ctfe
69+
mountSubPath: signer.pem
70+
storageDir:
71+
path: /storage
72+
name: ctlog
73+
volume:
74+
hostPath:
75+
path: /data/ctlog-storage
76+
type: Directory
77+
```
78+
79+
## Using the GCP backend
80+
81+
The deployment needs to be running in a GKE cluster with workload identity
82+
enabled and with permission to access secrets, storage objects, and Spanner
83+
databases.
84+
85+
In values.yaml, set `image.flavor` to `"gcp"`.
86+
87+
Create a Spanner instance and database in GCP:
88+
89+
```
90+
gcloud spanner instances create tesseract \
91+
--config=regional-us-west1 \
92+
--description="test" --nodes=1
93+
gcloud spanner databases create sequencer --instance tesseract
94+
# If using antispam, create the antispam database too:
95+
# gcloud spanner databases create antispam --instance tesseract
96+
```
97+
98+
Create a GCS bucket:
99+
100+
```
101+
gcloud storage buckets create gs://unique-tesseract-bucket-name
102+
```
103+
104+
Create secrets in Secret Manager for both the private and public keys:
105+
106+
```
107+
gcloud secrets create tesseract-private --data-file=/path/to/privkey.pem
108+
gcloud secrets create tesseract-public --data-file=/path/to/pubkey.pem
109+
```
110+
111+
Configure the Spanner path, bucket, and signer keys in values.yaml:
112+
113+
```
114+
server:
115+
...
116+
gcp:
117+
spanner: projects/my-project/instances/tesseract/databases/sequencer
118+
bucket: unique-tesseract-bucket-name
119+
signer:
120+
privateKey: projects/1234/secrets/tesseract-private/versions/1
121+
publicKey: projects/1234/secrets/tesseract-public/versions/1
122+
```
123+
124+
{{ template "chart.maintainersSection" . }}
125+
126+
{{ template "chart.sourcesSection" . }}
127+
128+
{{ template "chart.requirementsSection" . }}
129+
130+
{{ template "chart.valuesSection" . }}

0 commit comments

Comments
 (0)