mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Code Activity

feat: add flag to pass tuf root directly (#11103)

Browse source 
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
This commit is contained in:
Vishal Choudhary 2024-09-12 10:15:07 +05:30 committed by GitHub
parent fbb77dcb97
commit d0689000b6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 19 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
CHANGELOG.md
View file

@ -3,6 +3,7 @@
### Note ### Note
- Removed deprecated flag `reportsChunkSize`. - Removed deprecated flag `reportsChunkSize`.
- Added `--tufRootRaw` flag to pass tuf root for custom sigstore deployments.
## v1.11.0 ## v1.11.0

3
charts/kyverno/README.md
View file

@ -348,7 +348,8 @@ The chart values are organised per component.
| features.registryClient.credentialHelpers | list | `["default","google","amazon","azure","github"]` | Enable registry client helpers | | features.registryClient.credentialHelpers | list | `["default","google","amazon","azure","github"]` | Enable registry client helpers |
| features.ttlController.reconciliationInterval | string | `"1m"` | Reconciliation interval for the label based cleanup manager | | features.ttlController.reconciliationInterval | string | `"1m"` | Reconciliation interval for the label based cleanup manager |
| features.tuf.enabled | bool | `false` | Enables the feature | | features.tuf.enabled | bool | `false` | Enables the feature |
| features.tuf.root | string | `nil` | Tuf root | | features.tuf.root | string | `nil` | Path to Tuf root |
| features.tuf.rootRaw | string | `nil` | Raw Tuf root |
| features.tuf.mirror | string | `nil` | Tuf mirror | | features.tuf.mirror | string | `nil` | Tuf mirror |
### Admission controller ### Admission controller

3
charts/kyverno/templates/_helpers.tpl
View file

@ -87,6 +87,9 @@
{{- with .root -}} {{- with .root -}}
{{- $flags = append $flags (print "--tufRoot=" .) -}} {{- $flags = append $flags (print "--tufRoot=" .) -}}
{{- end -}} {{- end -}}
{{- with .rootRaw -}}
{{- $flags = append $flags (print "--tufRootRaw=" .) -}}
{{- end -}}
{{- end -}} {{- end -}}
{{- with $flags -}} {{- with $flags -}}
{{- toYaml . -}} {{- toYaml . -}}

4
charts/kyverno/values.yaml
View file

@ -696,8 +696,10 @@ features:
tuf: tuf:
# -- Enables the feature # -- Enables the feature
enabled: false enabled: false
# -- (string) Tuf root # -- (string) Path to Tuf root
root: ~ root: ~
# -- (string) Raw Tuf root
rootRaw: ~
# -- (string) Tuf mirror # -- (string) Tuf mirror
mirror: ~ mirror: ~

10
cmd/internal/flag.go
View file

@ -41,9 +41,10 @@ var (
exceptionNamespace string exceptionNamespace string
enableConfigMapCaching bool enableConfigMapCaching bool
// cosign // cosign
enableTUF bool enableTUF bool
tufMirror string tufMirror string
tufRoot string tufRoot string
tufRootRaw string
// registry client // registry client
imagePullSecrets string imagePullSecrets string
allowInsecureRegistry bool allowInsecureRegistry bool
@ -112,7 +113,8 @@ func initDeferredLoadingFlags() {
func initCosignFlags() { func initCosignFlags() {
flag.BoolVar(&enableTUF, "enableTuf", false, "enable tuf for private sigstore deployments") flag.BoolVar(&enableTUF, "enableTuf", false, "enable tuf for private sigstore deployments")
flag.StringVar(&tufMirror, "tufMirror", tuf.DefaultRemoteRoot, "Alternate TUF mirror for sigstore. If left blank, public sigstore one is used for cosign verification.") flag.StringVar(&tufMirror, "tufMirror", tuf.DefaultRemoteRoot, "Alternate TUF mirror for sigstore. If left blank, public sigstore one is used for cosign verification.")
flag.StringVar(&tufRoot, "tufRoot", "", "Alternate TUF root.json for sigstore. If left blank, public sigstore one is used for cosign verification.") flag.StringVar(&tufRoot, "tufRoot", "", "Path to alternate TUF root.json for sigstore (url or env). If left blank, public sigstore one is used for cosign verification.")
flag.StringVar(&tufRootRaw, "tufRootRaw", "", "The raw body of alternate TUF root.json for sigstore. If left blank, public sigstore one is used for cosign verification.")
} }
func initRegistryClientFlags() { func initRegistryClientFlags() {

5
cmd/internal/tuf.go
View file

@ -14,7 +14,7 @@ func setupSigstoreTUF(ctx context.Context, logger logr.Logger) {
return return
} }
logger = logger.WithName("sigstore-tuf").WithValues("tufroot", tufRoot, "tufmirror", tufMirror) logger = logger.WithName("sigstore-tuf").WithValues("tufRoot", tufRoot, "tufRootRaw", tufRootRaw, "tufMirror", tufMirror)
logger.Info("setup tuf client for sigstore...") logger.Info("setup tuf client for sigstore...")
var tufRootBytes []byte var tufRootBytes []byte
var err error var err error
@ -23,7 +23,10 @@ func setupSigstoreTUF(ctx context.Context, logger logr.Logger) {
if err != nil { if err != nil {
checkError(logger, err, fmt.Sprintf("Failed to read alternate TUF root file %s : %v", tufRoot, err)) checkError(logger, err, fmt.Sprintf("Failed to read alternate TUF root file %s : %v", tufRoot, err))
} }
} else if tufRootRaw != "" {
tufRootBytes = []byte(tufRootRaw)
} }
logger.Info("Initializing TUF root") logger.Info("Initializing TUF root")
if err := tuf.Initialize(ctx, tufMirror, tufRootBytes); err != nil { if err := tuf.Initialize(ctx, tufMirror, tufRootBytes); err != nil {
checkError(logger, err, fmt.Sprintf("Failed to initialize TUF client from %s : %v", tufRoot, err)) checkError(logger, err, fmt.Sprintf("Failed to initialize TUF client from %s : %v", tufRoot, err))