4.13. ビルド済みイメージ内の kmods への署名

前提条件

• keySecret および certSecret シークレットが、残りのリソースと同じ namespace に作成されている。

手順

• YAML ファイルを適用します。

  ---
  apiVersion: kmm.sigs.x-k8s.io/v1beta1
  kind: Module
  metadata:
    name: example-module
  spec:
    moduleLoader:
      serviceAccountName: default
      container:
        modprobe: 

  1

  
          moduleName: '<module_name>'
        kernelMappings:
          # the kmods will be deployed on all nodes in the cluster with a kernel that matches the regexp
          - regexp: '^.*\.x86_64$'
            # the container to produce containing the signed kmods
            containerImage: <image_name> 

  2

  
            sign:
              # the image containing the unsigned kmods (we need this because we are not building the kmods within the cluster)
              unsignedImage: <image_name> 

  3

  
              keySecret: # a secret holding the private secureboot key with the key 'key'
                name: <private_key_secret_name>
              certSecret: # a secret holding the public secureboot key with the key 'cert'
                name: <certificate_secret_name>
              filesToSign: # full path within the unsignedImage container to the kmod(s) to sign
                - /opt/lib/modules/4.18.0-348.2.1.el8_5.x86_64/kmm_ci_a.ko
    imageRepoSecret:
      # the name of a secret containing credentials to pull unsignedImage and push containerImage to the registry
      name: repo-pull-secret
    selector:
      kubernetes.io/arch: amd64