Skip to content
This repository was archived by the owner on Oct 3, 2023. It is now read-only.

Commit 8af25ea

Browse files
nicholasdillenicholasdille
committed
Checking keyless signature for k8s components
1 parent fe97b54 commit 8af25ea

File tree

13 files changed

+136
-16
lines changed

13 files changed

+136
-16
lines changed

‎tools/kube-apiserver/Dockerfile.template

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,31 @@
11
#syntax=docker/dockerfile:1.4.3
22

33
ARG ref=main
4-
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
54

5+
FROM ghcr.io/nicholasdille/docker-setup/cosign:${ref} AS cosign
6+
7+
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
8+
COPY --from=cosign / /
69
ARG name
710
ARG version
8-
911
RUN <<EOF
10-
curl --silent --location --output "${prefix}${target}/bin/kube-apiserver" \
11-
"https://storage.googleapis.com/kubernetes-release/release/v${version}/bin/linux/${alt_arch}/kube-apiserver"
12+
curl --silent --location --fail --output "${prefix}${target}/bin/kube-apiserver" \
13+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-apiserver"
1214
chmod +x "${prefix}${target}/bin/kube-apiserver"
15+
16+
if test "$(echo -e "1.26.0-beta.0\n${version}" | sort -V | head -n 1)" == "1.26.0-beta.0"; then
17+
echo "Verifying keyless signature for kube-apiserver"
18+
curl --silent --location --fail --output "/tmp/kube-apiserver.sig" \
19+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-apiserver.sig"
20+
curl --silent --location --fail --output "/tmp/kube-apiserver.cert" \
21+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-apiserver.cert"
22+
COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}${target}/bin/kube-apiserver" \
23+
--signature "/tmp/kube-apiserver.sig" \
24+
--certificate "/tmp/kube-apiserver.cert" \
25+
--certificate-oidc-issuer https://accounts.google.com \
26+
--certificate-email krel-staging@k8s-releng-prod.iam.gserviceaccount.com
27+
rm -f \
28+
"/tmp/kube-apiserver.sig" \
29+
"/tmp/kube-apiserver.cert"
30+
fi
1331
EOF

‎tools/kube-apiserver/manifest.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: kube-apiserver
22
version: "1.25.4"
33
check: ${binary} --version | cut -d' ' -f2 | tr -d v
4+
dependencies:
5+
- cosign
46
tags:
57
- org/cncf
68
- org/kubernetes

‎tools/kube-controller-manager/Dockerfile.template

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,31 @@
11
#syntax=docker/dockerfile:1.4.3
22

33
ARG ref=main
4-
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
54

5+
FROM ghcr.io/nicholasdille/docker-setup/cosign:${ref} AS cosign
6+
7+
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
8+
COPY --from=cosign / /
69
ARG name
710
ARG version
8-
911
RUN <<EOF
1012
curl --silent --location --output "${prefix}${target}/bin/kube-controller-manager" \
1113
"https://storage.googleapis.com/kubernetes-release/release/v${version}/bin/linux/${alt_arch}/kube-controller-manager"
1214
chmod +x "${prefix}${target}/bin/kube-controller-manager"
15+
16+
if test "$(echo -e "1.26.0-beta.0\n${version}" | sort -V | head -n 1)" == "1.26.0-beta.0"; then
17+
echo "Verifying keyless signature for kube-controller-manager"
18+
curl --silent --location --fail --output "/tmp/kube-controller-manager.sig" \
19+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-controller-manager.sig"
20+
curl --silent --location --fail --output "/tmp/kube-controller-manager.cert" \
21+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-controller-manager.cert"
22+
COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}${target}/bin/kube-controller-manager" \
23+
--signature "/tmp/kube-controller-manager.sig" \
24+
--certificate "/tmp/kube-controller-manager.cert" \
25+
--certificate-oidc-issuer https://accounts.google.com \
26+
--certificate-email krel-staging@k8s-releng-prod.iam.gserviceaccount.com
27+
rm -f \
28+
"/tmp/kube-controller-manager.sig" \
29+
"/tmp/kube-controller-manager.cert"
30+
fi
1331
EOF

‎tools/kube-controller-manager/manifest.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: kube-controller-manager
22
version: "1.25.4"
33
check: ${binary} --version | cut -d' ' -f2 | tr -d v
4+
dependencies:
5+
- cosign
46
tags:
57
- org/cncf
68
- org/kubernetes

‎tools/kube-proxy/Dockerfile.template

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,31 @@
11
#syntax=docker/dockerfile:1.4.3
22

33
ARG ref=main
4-
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
54

5+
FROM ghcr.io/nicholasdille/docker-setup/cosign:${ref} AS cosign
6+
7+
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
8+
COPY --from=cosign / /
69
ARG name
710
ARG version
8-
911
RUN <<EOF
1012
curl --silent --location --output "${prefix}${target}/bin/kube-proxy" \
1113
"https://storage.googleapis.com/kubernetes-release/release/v${version}/bin/linux/${alt_arch}/kube-proxy"
1214
chmod +x "${prefix}${target}/bin/kube-proxy"
15+
16+
if test "$(echo -e "1.26.0-beta.0\n${version}" | sort -V | head -n 1)" == "1.26.0-beta.0"; then
17+
echo "Verifying keyless signature for kube-proxy"
18+
curl --silent --location --fail --output "/tmp/kube-proxy.sig" \
19+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-proxy.sig"
20+
curl --silent --location --fail --output "/tmp/kube-proxy.cert" \
21+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-proxy.cert"
22+
COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}${target}/bin/kube-proxy" \
23+
--signature "/tmp/kube-proxy.sig" \
24+
--certificate "/tmp/kube-proxy.cert" \
25+
--certificate-oidc-issuer https://accounts.google.com \
26+
--certificate-email krel-staging@k8s-releng-prod.iam.gserviceaccount.com
27+
rm -f \
28+
"/tmp/kube-proxy.sig" \
29+
"/tmp/kube-proxy.cert"
30+
fi
1331
EOF

‎tools/kube-proxy/manifest.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: kube-proxy
22
version: "1.25.4"
33
check: ${binary} --version | cut -d' ' -f2 | tr -d v
4+
dependencies:
5+
- cosign
46
tags:
57
- org/cncf
68
- org/kubernetes

‎tools/kube-scheduler/Dockerfile.template

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,31 @@
11
#syntax=docker/dockerfile:1.4.3
22

33
ARG ref=main
4-
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
54

5+
FROM ghcr.io/nicholasdille/docker-setup/cosign:${ref} AS cosign
6+
7+
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
8+
COPY --from=cosign / /
69
ARG name
710
ARG version
8-
911
RUN <<EOF
1012
curl --silent --location --output "${prefix}${target}/bin/kube-scheduler" \
1113
"https://storage.googleapis.com/kubernetes-release/release/v${version}/bin/linux/${alt_arch}/kube-scheduler"
1214
chmod +x "${prefix}${target}/bin/kube-scheduler"
15+
16+
if test "$(echo -e "1.26.0-beta.0\n${version}" | sort -V | head -n 1)" == "1.26.0-beta.0"; then
17+
echo "Verifying keyless signature for kube-scheduler"
18+
curl --silent --location --fail --output "/tmp/kube-scheduler.sig" \
19+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-scheduler.sig"
20+
curl --silent --location --fail --output "/tmp/kube-scheduler.cert" \
21+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kube-scheduler.cert"
22+
COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}${target}/bin/kube-scheduler" \
23+
--signature "/tmp/kube-scheduler.sig" \
24+
--certificate "/tmp/kube-scheduler.cert" \
25+
--certificate-oidc-issuer https://accounts.google.com \
26+
--certificate-email krel-staging@k8s-releng-prod.iam.gserviceaccount.com
27+
rm -f \
28+
"/tmp/kube-scheduler.sig" \
29+
"/tmp/kube-scheduler.cert"
30+
fi
1331
EOF

‎tools/kube-scheduler/manifest.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: kube-scheduler
22
version: "1.25.4"
33
check: ${binary} --version | cut -d' ' -f2 | tr -d v
4+
dependencies:
5+
- cosign
46
tags:
57
- org/cncf
68
- org/kubernetes

‎tools/kubeadm/Dockerfile.template

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,35 @@
11
#syntax=docker/dockerfile:1.4.3
22

33
ARG ref=main
4-
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
54

5+
FROM ghcr.io/nicholasdille/docker-setup/cosign:${ref} AS cosign
6+
7+
FROM ghcr.io/nicholasdille/docker-setup/base:${ref} AS prepare
8+
COPY --from=cosign / /
69
ARG name
710
ARG version
8-
911
COPY kubelet.service ${prefix}/etc/systemd/system/
10-
1112
RUN <<EOF
1213
curl --silent --location --output "${prefix}${target}/bin/kubeadm" \
1314
"https://storage.googleapis.com/kubernetes-release/release/v${version}/bin/linux/${alt_arch}/kubeadm"
1415
chmod +x "${prefix}${target}/bin/kubeadm"
16+
17+
if test "$(echo -e "1.26.0-beta.0\n${version}" | sort -V | head -n 1)" == "1.26.0-beta.0"; then
18+
echo "Verifying keyless signature for kubeadm"
19+
curl --silent --location --fail --output "/tmp/kubeadm.sig" \
20+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kubeadm.sig"
21+
curl --silent --location --fail --output "/tmp/kubeadm.cert" \
22+
"https://dl.k8s.io/release/v${version}/bin/linux/amd64/kubeadm.cert"
23+
COSIGN_EXPERIMENTAL=1 cosign verify-blob "${prefix}${target}/bin/kubeadm" \
24+
--signature "/tmp/kubeadm.sig" \
25+
--certificate "/tmp/kubeadm.cert" \
26+
--certificate-oidc-issuer https://accounts.google.com \
27+
--certificate-email krel-staging@k8s-releng-prod.iam.gserviceaccount.com
28+
rm -f \
29+
"/tmp/kubeadm.sig" \
30+
"/tmp/kubeadm.cert"
31+
fi
32+
1533
"${prefix}${target}/bin/kubeadm" completion bash >"${prefix}${target}/share/bash-completion/completions/kubeadm"
1634
"${prefix}${target}/bin/kubeadm" completion zsh >"${prefix}${target}/share/zsh/vendor-completions/_kubeadm"
1735
EOF

‎tools/kubeadm/manifest.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ version: "1.25.4"
33
check: ${binary} version --output short | tr -d v
44
dependencies:
55
- kubelet
6+
- cosign
67
tags:
78
- org/cncf
89
- org/kubernetes

0 commit comments

Comments
 (0)