4.7. Signer un conteneur de pilote préconstruit

Procédure

1. Appliquer le fichier YAML :

   Copy to Clipboard Toggle word wrap

   ---
   apiVersion: kmm.sigs.x-k8s.io/v1beta1
   kind: Module
   metadata:
     name: example-module
   spec:
     moduleLoader:
       serviceAccountName: default
       container:
         modprobe: 

   1

   
           moduleName: '<your module name>'
         kernelMappings:
           # the kmods will be deployed on all nodes in the cluster with a kernel that matches the regexp
           - regexp: '^.*\.x86_64$'
             # the container to produce containing the signed kmods
             containerImage: <image name e.g. quay.io/myuser/my-driver:<kernelversion>-signed>
             sign:
               # the image containing the unsigned kmods (we need this because we are not building the kmods within the cluster)
               unsignedImage: <image name e.g. quay.io/myuser/my-driver:<kernelversion> >
               keySecret: # a secret holding the private secureboot key with the key 'key'
                 name: <private key secret name>
               certSecret: # a secret holding the public secureboot key with the key 'cert'
                 name: <certificate secret name>
               filesToSign: # full path within the unsignedImage container to the kmod(s) to sign
                 - /opt/lib/modules/4.18.0-348.2.1.el8_5.x86_64/kmm_ci_a.ko
     imageRepoSecret:
       # the name of a secret containing credentials to pull unsignedImage and push containerImage to the registry
       name: repo-pull-secret
     selector:
       kubernetes.io/arch: amd64