📖 Add documentation on how to gate upgrades with kyverno #1135
Conversation
Signed-off-by: mudler <[email protected]>
✅ Deploy Preview for kairos-io ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
|
cc @jimmykarily , might be helpful as a baseline for the #1114 story |
Signed-off-by: mudler <[email protected]>
| - [kairos](https://github.com/kairos-io/kairos) is the main repository, building the `kairos-agent` and containing the image definitions which runs on our CI pipelines. | ||
| - [immucore](https://github.com/kairos-io/immucore) is the immutability management interface. | ||
| - [AuroraBoot](https://github.com/kairos-io/AuroraBoot) is the Kairos Node bootstrapper | ||
| - [elemental-cli](https://github.com/kairos-io/elemental-cli) manages the installation, reset, and upgrade of the Kairos node. |
| - entries: | ||
| # See: https://kyverno.io/docs/writing-policies/verify-images/#keyless-signing-and-verification | ||
| - keyless: | ||
| subject: "https://github.com/kairos-io/provider-kairos/.github/workflows/release.yaml@refs/tags/*" |
There was a problem hiding this comment.
this is kind of icky.
Hear me out, this is really good until cosign or the CI breaks and we need to sign the already published artifacts in a different way, maybe by a different workflows like we used to do in that other project. Then this doesnt match anymore so you either drop a release completely as it wont be signed, resign it and break this gating for users or run a new release and left the unsigned release there.
does this subject allows for regex? or for value.in so we can provide a list?
There was a problem hiding this comment.
that's a valid and good point the subject is a regex already indeed: https://github.com/kairos-io/provider-kairos/.github/workflows/release.yaml@refs/tags/* I think it's fine as a baseline example and nothing more, for instance, a policy can be applied also per-releases prior applying a plan, and so on so forth, it's up to you to which kinda of policy you want to set - this one is very greedy and assumes all provider-kairos repository are from that CI pipeline.
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):Fixes #564