diff --git a/charts/cosigned/Chart.yaml b/charts/cosigned/Chart.yaml index aa6b16cb..06ec8552 100644 --- a/charts/cosigned/Chart.yaml +++ b/charts/cosigned/Chart.yaml @@ -8,7 +8,7 @@ sources: type: application name: cosigned -version: v0.1.0 +version: v0.1.1 appVersion: v1.3.0 maintainers: diff --git a/charts/cosigned/README.md b/charts/cosigned/README.md index c059d4c8..ff528c6c 100644 --- a/charts/cosigned/README.md +++ b/charts/cosigned/README.md @@ -18,9 +18,7 @@ The previous command generates two key files `cosign.key` and `cosign.pub`. Next kubectl create namespace cosign-system kubectl create secret generic mysecret -n \ -cosign-system --from-file=cosign.pub=./cosign.pub \ ---from-file=cosign.key=./cosign.key \ ---from-literal=cosign.password=$COSIGN_PASSWORD +cosign-system --from-file=cosign.pub=./cosign.pub ``` Install `cosigned` using Helm and setting the value of the secret key reference to `mysecret` that you created above: @@ -30,7 +28,7 @@ helm repo add sigstore https://sigstore.github.io/helm-charts helm repo update -helm install cosigned -n cosign-system sigstore/cosigned --devel --set webhook.secretKeyRef.name=mysecret +helm install cosigned -n cosign-system sigstore/cosigned --devel --set cosign.secretKeyRef.name=mysecret ``` ### Enabling Admission control diff --git a/charts/cosigned/templates/webhook/cosign_secret.yaml b/charts/cosigned/templates/webhook/cosign_secret.yaml index fcede41f..28ae53d9 100644 --- a/charts/cosigned/templates/webhook/cosign_secret.yaml +++ b/charts/cosigned/templates/webhook/cosign_secret.yaml @@ -1,3 +1,4 @@ +{{- if .Values.cosign.cosignPub }} apiVersion: v1 kind: Secret metadata: @@ -7,6 +8,7 @@ metadata: namespace: {{ .Release.Namespace }} type: Opaque data: - cosign.key: {{ .Values.cosign.cosignKey}} - cosign.password: {{ .Values.cosign.cosignPassword}} + cosign.key: {{ default "" .Values.cosign.cosignKey}} + cosign.password: {{ default "" .Values.cosign.cosignPassword}} cosign.pub: {{ .Values.cosign.cosignPub}} +{{- end -}} \ No newline at end of file diff --git a/charts/cosigned/templates/webhook/deployment_webhook.yaml b/charts/cosigned/templates/webhook/deployment_webhook.yaml index 0f17c12a..fe6d9fc2 100644 --- a/charts/cosigned/templates/webhook/deployment_webhook.yaml +++ b/charts/cosigned/templates/webhook/deployment_webhook.yaml @@ -48,7 +48,13 @@ spec: {{- end }} {{- end }} args: + {{- if and .Values.cosign.secretKeyRef }} + {{- if .Values.cosign.secretKeyRef.name }} + - -secret-name="{{ .Values.cosign.secretKeyRef.name }}" + {{- end }} + {{- else }} - -secret-name={{ template "cosigned.fullname" . }}-cosign-key + {{- end }} {{- range $key, $value := .Values.webhook.extraArgs }} - -{{ $key }}={{ $value }} {{- end }} diff --git a/charts/cosigned/values.yaml b/charts/cosigned/values.yaml index 27f87f96..37b8a5f8 100644 --- a/charts/cosigned/values.yaml +++ b/charts/cosigned/values.yaml @@ -1,4 +1,6 @@ cosign: + secretKeyRef: + name: # add the values in base64 encoded cosignKey: cosignPub: