Repository navigation
Sigstore: accept a cluster's public ServiceAccount issuer alongside the kind default - #114
Merged
Merged
Conversation
…he kind default fulcio.publicIssuers (control-plane) adds issuers to fulcio-config; the bootstrap hook now rewrites fulcio-config on every sync (the signing root is still minted once) and restarts fulcio-server when it changes, since config.yaml is a subPath mount. sigstoreIssuers (catalog) is the list the verify Tasks accept, via --certificate-oidc-issuer-regexp with each entry quoted. Defaults are unchanged and render byte-identical to kiac-dev's live fulcio-config. Groundwork for kiac-dev signing tokens as https://hangarplatform.dev/oidc/kiac-dev (IRSA-style AWS federation for Crossplane). docs/admin/image-signing.md has the staged switch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets Fulcio and the verify Tasks accept a cluster's own public ServiceAccount issuer next to the kind default, so a cluster can switch issuers without breaking keyless signing. First user: kiac-dev →
https://hangarplatform.dev/oidc/kiac-dev(IRSA-style AWS federation for Crossplane's AWS providers).Changes
glidepath-control-plane: newfulcio.publicIssuers(default[]). Thefulcio-bootstraphook now rewritesfulcio-configon every sync; the signing root is still minted only once. It restartsfulcio-serverwhen the config changes, becauseconfig.yamlis asubPathmount. The Role gainsget/patchondeployments/fulcio-serveronly.glidepath-catalog: newsigstoreIssuers(default: the kind issuer).verify-image-provenanceandverify-sast-attestationuse--certificate-oidc-issuer-regexp '^(a|b)$', with each entry escaped throughregexQuoteMeta.docs/admin/image-signing.md: the staged issuer switch.Checks
publicIssuers: [], the regeneratedfulcio-configis byte-identical to kiac-dev's live one (1409 bytes), so the hook logs "unchanged" and nothing restarts.helm lintpasses on both charts. The rendered hook script passesbash -nwith and without a public issuer, and theSERVERCONFIGheredoc terminator is still at column 0.prepare()), and is retried on demand (GetVerifier). An entry withoutca-certuses system roots. Egress fromfulcio-systemto hangarplatform.dev returned 200 from a probe pod.The kiac-dev values that turn it on go in a separate gitops-cluster-dev PR.
🤖 Generated with Claude Code