Chains Getting Started Tutorial

This tutorial will guide you through:

• Generating your own keypair and storing it as a Kubernetes Secret
• Configuring Tekton Chains backend storage
• Creating a sample TaskRun
• Retrieving the signature and payload from the signed TaskRun
• Verifying the signature

We will be creating a TaskRun, signing it, and storing the signature and the payload as annotations on the TaskRun itself. So, no additional authentication should be required!

For this tutorial we will use the x509 key type.

x509

To generate your own encrypted x509 keypair and save it as a Kubernetes secret, install cosign and run the following:

cosign generate-key-pair k8s://tekton-chains/signing-secrets 

cosign will prompt you for a password, which will be stored in a Kubernetes secret named signing-secrets in the tekton-chains namespace.

Configuring Tekton Chains

You will need to make sure that OCI storage is disabled and that the taskrun storage and format is set to tekton.

You can set these fields by running the following command:

kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"artifacts.oci.storage": "", "artifacts.taskrun.format":"in-toto", "artifacts.taskrun.storage": "tekton"}}' 

Then restart the controller to ensure it picks up the changes:

kubectl delete po -n tekton-chains -l app=tekton-chains-controller 

This tells Chains to use the default tekton artifact (enabled by default) and disable the OCI artifact.

To create a simple TaskRun, run:

$ kubectl create -f https://raw.githubusercontent.com/tektoncd/chains/main/examples/taskruns/task-output-image.yaml taskrun.tekton.dev/build-push-run-output-image-qbjvh created 

Wait for it to finish (all the steps should be marked as Completed).

$ tkn tr describe --last  [...truncated output...]  🦶 Steps  NAME STATUS ∙ create-dir-builtimage-9467f Completed ∙ git-source-sourcerepo-p2sk8 Completed ∙ build-and-push Completed ∙ echo Completed ∙ image-digest-exporter-xlkn7 Completed 

Next, retrieve the signature and payload from the object (they are stored as base64-encoded annotations):

export TASKRUN_UID=$(tkn tr describe --last -o jsonpath='{.metadata.uid}') tkn tr describe --last -o jsonpath="{.metadata.annotations.chains\.tekton\.dev/signature-taskrun-$TASKRUN_UID}" | base64 -d > sig 

Finally, we can check the signature with cosign:

$ cosign verify-blob-attestation --insecure-ignore-tlog --key k8s://tekton-chains/signing-secrets --signature sig --type slsaprovenance --check-claims=false /dev/null Verified OK 

$ cosign verify-blob --key k8s://tekton-chains/signing-secrets --signature sig sig Verified OK 

Now we have a verifiable record of the TaskRun!

What you just created

This diagram shows what you just deployed: