-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fulcio e2e testing / K8s OIDC / ephemeralca
#219
Conversation
There are several parts to this change: 1. Implement a new `ephemeralca` that just generates an in-memory certificate, 1. Rename `pkg/ca/pkcs11ca` to `pkg/ca/x509ca` since it had nothing `PKCS11` specific (shared with `ephemeralca` logic), 1. Add support for Kubernetes OIDC via Service Account Projected Volumes, 1. Have the KinD e2e test use `ephemeralca` and `cosign sign` an image. I can split some of these pieces apart, but wanted to get this all working end-to-end, since a key goal was enabling e2e testing on KinD. This follows a lot of the ideas from: https://github.com/mattmoor/kind-oidc Related: sigstore#212 Fixes: sigstore#194 Signed-off-by: Matt Moore <[email protected]>
This change adds an ambient OIDC provider that will enable when the following filesystem path is populated: `/var/run/sigstore/cosign/oidc-token`. The intended use of this (primarily) is to enable consuming Kubernetes OIDC tokens produced through Service Account Projected Volumes. To consume this you would add the following to your Kubernetes pod spec: ```yaml containers: - name: my-container-name image: ... volumeMounts: - name: oidc-info mountPath: /var/run/sigstore/cosign volumes: - name: oidc-info projected: sources: - serviceAccountToken: path: oidc-token expirationSeconds: 600 # Use as short-lived as possible. audience: sigstore ``` This would also work with Tekton step definitions, or other things that permit the use of projected volumes. Note: Fulcio doesn't currently allow any Kubernetes provider OIDC tokens on the public instance, but one of the things I plan to look at next is supporting the endpoints from GKE and EKS (both of which have public discovery endpoints). Related: sigstore/fulcio#219 Related: sigstore/fulcio#212 Signed-off-by: Matt Moore <[email protected]>
This change adds an ambient OIDC provider that will enable when the following filesystem path is populated: `/var/run/sigstore/cosign/oidc-token`. The intended use of this (primarily) is to enable consuming Kubernetes OIDC tokens produced through Service Account Projected Volumes. To consume this you would add the following to your Kubernetes pod spec: ```yaml containers: - name: my-container-name image: ... volumeMounts: - name: oidc-info mountPath: /var/run/sigstore/cosign volumes: - name: oidc-info projected: sources: - serviceAccountToken: path: oidc-token expirationSeconds: 600 # Use as short-lived as possible. audience: sigstore ``` This would also work with Tekton step definitions, or other things that permit the use of projected volumes. Note: Fulcio doesn't currently allow any Kubernetes provider OIDC tokens on the public instance, but one of the things I plan to look at next is supporting the endpoints from GKE and EKS (both of which have public discovery endpoints). Related: sigstore/fulcio#219 Related: sigstore/fulcio#212 Signed-off-by: Matt Moore <[email protected]>
@@ -25,12 +25,11 @@ import ( | |||
"net/url" | |||
"time" | |||
|
|||
"github.com/ThalesIgnite/crypto11" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We need the crypto11 library for handling the pkcs11 session (that references the privkey instance) and I can't see any type assertion for the interface that replaces it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The only use of this (in this file) was the type in the signature of the function, and that parameter was passed to a function that takes interface{}
. The library will still be linked into the final executable as it is still referenced in both ./pkg/pkcs11
and ./cmd/app
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We lose a tiny bit of type safety here I guess but it does make it easier to call. I don't think it matters much either way.
This change adds an ambient OIDC provider that will enable when the following filesystem path is populated: `/var/run/sigstore/cosign/oidc-token`. The intended use of this (primarily) is to enable consuming Kubernetes OIDC tokens produced through Service Account Projected Volumes. To consume this you would add the following to your Kubernetes pod spec: ```yaml containers: - name: my-container-name image: ... volumeMounts: - name: oidc-info mountPath: /var/run/sigstore/cosign volumes: - name: oidc-info projected: sources: - serviceAccountToken: path: oidc-token expirationSeconds: 600 # Use as short-lived as possible. audience: sigstore ``` This would also work with Tekton step definitions, or other things that permit the use of projected volumes. Note: Fulcio doesn't currently allow any Kubernetes provider OIDC tokens on the public instance, but one of the things I plan to look at next is supporting the endpoints from GKE and EKS (both of which have public discovery endpoints). Related: sigstore/fulcio#219 Related: sigstore/fulcio#212 Signed-off-by: Matt Moore <[email protected]>
This change adds an ambient OIDC provider that will enable when the following filesystem path is populated: `/var/run/sigstore/cosign/oidc-token`. The intended use of this (primarily) is to enable consuming Kubernetes OIDC tokens produced through Service Account Projected Volumes. To consume this you would add the following to your Kubernetes pod spec: ```yaml containers: - name: my-container-name image: ... volumeMounts: - name: oidc-info mountPath: /var/run/sigstore/cosign volumes: - name: oidc-info projected: sources: - serviceAccountToken: path: oidc-token expirationSeconds: 600 # Use as short-lived as possible. audience: sigstore ``` This would also work with Tekton step definitions, or other things that permit the use of projected volumes. Note: Fulcio doesn't currently allow any Kubernetes provider OIDC tokens on the public instance, but one of the things I plan to look at next is supporting the endpoints from GKE and EKS (both of which have public discovery endpoints). Related: sigstore/fulcio#219 Related: sigstore/fulcio#212 Signed-off-by: Matt Moore <[email protected]>
This change adds an ambient OIDC provider that will enable when the following filesystem path is populated: `/var/run/sigstore/cosign/oidc-token`. The intended use of this (primarily) is to enable consuming Kubernetes OIDC tokens produced through Service Account Projected Volumes. To consume this you would add the following to your Kubernetes pod spec: ```yaml containers: - name: my-container-name image: ... volumeMounts: - name: oidc-info mountPath: /var/run/sigstore/cosign volumes: - name: oidc-info projected: sources: - serviceAccountToken: path: oidc-token expirationSeconds: 600 # Use as short-lived as possible. audience: sigstore ``` This would also work with Tekton step definitions, or other things that permit the use of projected volumes. Note: Fulcio doesn't currently allow any Kubernetes provider OIDC tokens on the public instance, but one of the things I plan to look at next is supporting the endpoints from GKE and EKS (both of which have public discovery endpoints). Related: sigstore/fulcio#219 Related: sigstore/fulcio#212 Signed-off-by: Matt Moore <[email protected]> Signed-off-by: Billy Lynch <[email protected]>
This change adds an ambient OIDC provider that will enable when the following filesystem path is populated: `/var/run/sigstore/cosign/oidc-token`. The intended use of this (primarily) is to enable consuming Kubernetes OIDC tokens produced through Service Account Projected Volumes. To consume this you would add the following to your Kubernetes pod spec: ```yaml containers: - name: my-container-name image: ... volumeMounts: - name: oidc-info mountPath: /var/run/sigstore/cosign volumes: - name: oidc-info projected: sources: - serviceAccountToken: path: oidc-token expirationSeconds: 600 # Use as short-lived as possible. audience: sigstore ``` This would also work with Tekton step definitions, or other things that permit the use of projected volumes. Note: Fulcio doesn't currently allow any Kubernetes provider OIDC tokens on the public instance, but one of the things I plan to look at next is supporting the endpoints from GKE and EKS (both of which have public discovery endpoints). Related: sigstore/fulcio#219 Related: sigstore/fulcio#212 Signed-off-by: Matt Moore <[email protected]> Signed-off-by: Billy Lynch <[email protected]>
There are several parts to this change:
ephemeralca
that just generates an in-memory certificate,pkg/ca/pkcs11ca
topkg/ca/x509ca
since it had nothingPKCS11
specific (shared withephemeralca
logic),ephemeralca
andcosign sign
an image.I can split some of these pieces apart, but wanted to get this all working end-to-end, since a key goal was enabling e2e testing on KinD.
This follows a lot of the ideas from: https://github.com/mattmoor/kind-oidc
Signed-off-by: Matt Moore [email protected]
Ticket Link
Related: #212
Fixes: #194
Release Note