Chapter 1. Using Tekton Chains for OpenShift Pipelines supply chain security

Procedure

1. Set the namespace and name of the Kubernetes service account.

   $ export NAMESPACE=<namespace> 1
   $ export SERVICE_ACCOUNT_NAME=<service_account> 2

   1

   The namespace associated with the service account.

   2

   The name of the service account.

2. Create a Kubernetes secret.

   $ oc create secret registry-credentials \
     --from-file=.dockerconfigjson \ 1
     --type=kubernetes.io/dockerconfigjson \
     -n $NAMESPACE

   1

   Substitute with the path to your Docker config file. Default path is ~/.docker/config.json.

3. Give the service account access to the secret.

   $ oc patch serviceaccount $SERVICE_ACCOUNT_NAME \
     -p "{\"imagePullSecrets\": [{\"name\": \"registry-credentials\"}]}" -n $NAMESPACE

   If you patch the default pipeline service account that Red Hat OpenShift Pipelines assigns to all task runs, the Red Hat OpenShift Pipelines Operator will override the service account. As a best practice, you can perform the following steps:

   1. Create a separate service account to assign to user’s task runs.

      $ oc create serviceaccount <service_account_name>

   2. Associate the service account to the task runs by setting the value of the serviceaccountname field in the task run template.

      apiVersion: tekton.dev/v1
      kind: TaskRun
      metadata:
        name: build-push-task-run-2
      spec:
        taskRunTemplate:
          serviceAccountName: build-bot 1
        taskRef:
          name: build-push
      ...

      1

      Substitute with the name of the newly created service account.

Procedure

1. Create an encrypted x509 key pair and save it as a Kubernetes secret. For more information about creating a key pair and saving it as a secret, see "Signing secrets in Tekton Chains".

2. In the Tekton Chains configuration, disable the OCI storage, and set the task run storage and format to tekton. In the TektonConfig custom resource set the following values:

   apiVersion: operator.tekton.dev/v1alpha1
   kind: TektonConfig
   metadata:
     name: config
   spec:
   # ...
       chain:
         artifacts.oci.storage: ""
         artifacts.taskrun.format: tekton
         artifacts.taskrun.storage: tekton
   # ...

   For more information about configuring Tekton Chains using the TektonConfig custom resource, see "Configuring Tekton Chains".

3. To restart the Tekton Chains controller to ensure that the modified configuration is applied, enter the following command:

   $ oc delete po -n openshift-pipelines -l app=tekton-chains-controller

4. Create a task run by entering the following command:

   $ oc create -f https://raw.githubusercontent.com/tektoncd/chains/main/examples/taskruns/task-output-image.yaml 1

   1

   Replace the example URI with the URI or file path pointing to your task run.

   Example output

   taskrun.tekton.dev/build-push-run-output-image-qbjvh created

5. Check the status of the steps by entering the following command. Wait until the process finishes.

   $ tkn tr describe --last

   Example output

   [...truncated output...]
   NAME                            STATUS
   ∙ create-dir-builtimage-9467f   Completed
   ∙ git-source-sourcerepo-p2sk8   Completed
   ∙ build-and-push                Completed
   ∙ echo                          Completed
   ∙ image-digest-exporter-xlkn7   Completed

6. To retrieve the signature from the object stored as base64 encoded annotations, enter the following commands:

   $ tkn tr describe --last -o jsonpath="{.metadata.annotations.chains\.tekton\.dev/signature-taskrun-$TASKRUN_UID}" | base64 -d > sig

   $ export TASKRUN_UID=$(tkn tr describe --last -o  jsonpath='{.metadata.uid}')

7. To verify the signature using the public key that you created, enter the following command:

Procedure

1. Create an encrypted x509 key pair and save it as a Kubernetes secret:

   $ cosign generate-key-pair k8s://openshift-pipelines/signing-secrets

   Provide a password when prompted. Cosign stores the resulting private key as part of the signing-secrets Kubernetes secret in the openshift-pipelines namespace, and writes the public key to the cosign.pub local file.

2. Configure authentication for the image registry.

   1. To configure the Tekton Chains controller for pushing signature to an OCI registry, use the credentials associated with the service account of the task run. For detailed information, see the "Authenticating to an OCI registry" section.

   2. To configure authentication for a Kaniko task that builds and pushes image to the registry, create a Kubernetes secret of the docker config.json file containing the required credentials.

      $ oc create secret generic <docker_config_secret_name> \ 1
        --from-file <path_to_config.json> 2

      1

      Substitute with the name of the docker config secret.

      2

      Substitute with the path to docker config.json file.

3. Configure Tekton Chains by setting the artifacts.taskrun.format, artifacts.taskrun.storage, and transparency.enabled parameters in the chains-config object:

   $ oc patch configmap chains-config -n openshift-pipelines -p='{"data":{"artifacts.taskrun.format": "in-toto"}}'
   
   $ oc patch configmap chains-config -n openshift-pipelines -p='{"data":{"artifacts.taskrun.storage": "oci"}}'
   
   $ oc patch configmap chains-config -n openshift-pipelines -p='{"data":{"transparency.enabled": "true"}}'

4. Start the Kaniko task.

   1. Apply the Kaniko task to the cluster.

      $ oc apply -f examples/kaniko/kaniko.yaml 1

      1

      Substitute with the URI or file path to your Kaniko task.

   2. Set the appropriate environment variables.

      $ export REGISTRY=<url_of_registry> 1
      
      $ export DOCKERCONFIG_SECRET_NAME=<name_of_the_secret_in_docker_config_json> 2

      1

      Substitute with the URL of the registry where you want to push the image.

      2

      Substitute with the name of the secret in the docker config.json file.

   3. Start the Kaniko task.

      $ tkn task start --param IMAGE=$REGISTRY/kaniko-chains --use-param-defaults --workspace name=source,emptyDir="" --workspace name=dockerconfig,secret=$DOCKERCONFIG_SECRET_NAME kaniko-chains

      Observe the logs of this task until all steps are complete. On successful authentication, the final image will be pushed to $REGISTRY/kaniko-chains.

5. Wait for a minute to allow Tekton Chains to generate the provenance and sign it, and then check the availability of the chains.tekton.dev/signed=true annotation on the task run.

   $ oc get tr <task_run_name> \ 1
   -o json | jq -r .metadata.annotations
   
   {
     "chains.tekton.dev/signed": "true",
     ...
   }

   1

   Substitute with the name of the task run.

6. Verify the image and the attestation.

   $ cosign verify --key cosign.pub $REGISTRY/kaniko-chains
   
   $ cosign verify-attestation --key cosign.pub $REGISTRY/kaniko-chains

7. Find the provenance for the image in Rekor.

   1. Get the digest of the $REGISTRY/kaniko-chains image. You can search for it ing the task run, or pull the image to extract the digest.

   2. Search Rekor to find all entries that match the sha256 digest of the image.

      $ rekor-cli search --sha <image_digest> 1
      
      <uuid_1> 2
      <uuid_2> 3
      ...

      1

      Substitute with the sha256 digest of the image.

      2

      The first matching universally unique identifier (UUID).

      3

      The second matching UUID.

      The search result displays UUIDs of the matching entries. One of those UUIDs holds the attestation.

   3. Check the attestation.

      $ rekor-cli get --uuid <uuid> --format json | jq -r .Attestation | base64 --decode | jq