개인용 작업자에 Tekton Chains 설정

명령행을 사용하여 Tekton 프레임워크, 개인용 작업자 에이전트 프레임워크 및 Tekton 체인 프레임워크를 설치하십시오. &chains=true 를 명령행에 추가하여 개인용 작업자 프레임워크를 설치하십시오. 예를 들어, IBM Cloud Kubernetes Service 클러스터에서 다음 명령을 사용할 수 있습니다.

kubectl apply --filename "https://private-worker-service.{REGION}.devops.cloud.ibm.com/install?type=iks&olm=false&chains=true"

다음 예제 출력을 참조하십시오.

namespace/tekton-pipelines created
clusterrole.rbac.authorization.k8s.io/tekton-pipelines-controller-cluster-access created
clusterrole.rbac.authorization.k8s.io/tekton-pipelines-controller-tenant-access created
clusterrole.rbac.authorization.k8s.io/tekton-pipelines-webhook-cluster-access created
role.rbac.authorization.k8s.io/tekton-pipelines-controller created
role.rbac.authorization.k8s.io/tekton-pipelines-webhook created
role.rbac.authorization.k8s.io/tekton-pipelines-leader-election created
role.rbac.authorization.k8s.io/tekton-pipelines-info created
serviceaccount/tekton-pipelines-controller created
serviceaccount/tekton-pipelines-webhook created
clusterrolebinding.rbac.authorization.k8s.io/tekton-pipelines-controller-cluster-access created
clusterrolebinding.rbac.authorization.k8s.io/tekton-pipelines-controller-tenant-access created
clusterrolebinding.rbac.authorization.k8s.io/tekton-pipelines-webhook-cluster-access created
rolebinding.rbac.authorization.k8s.io/tekton-pipelines-controller created
rolebinding.rbac.authorization.k8s.io/tekton-pipelines-webhook created
rolebinding.rbac.authorization.k8s.io/tekton-pipelines-controller-leaderelection created
rolebinding.rbac.authorization.k8s.io/tekton-pipelines-webhook-leaderelection created
rolebinding.rbac.authorization.k8s.io/tekton-pipelines-info created
customresourcedefinition.apiextensions.k8s.io/clustertasks.tekton.dev created
customresourcedefinition.apiextensions.k8s.io/customruns.tekton.dev created
customresourcedefinition.apiextensions.k8s.io/pipelines.tekton.dev created
customresourcedefinition.apiextensions.k8s.io/pipelineruns.tekton.dev created
customresourcedefinition.apiextensions.k8s.io/resolutionrequests.resolution.tekton.dev created
customresourcedefinition.apiextensions.k8s.io/tasks.tekton.dev created
customresourcedefinition.apiextensions.k8s.io/taskruns.tekton.dev created
customresourcedefinition.apiextensions.k8s.io/verificationpolicies.tekton.dev created
secret/webhook-certs created
validatingwebhookconfiguration.admissionregistration.k8s.io/validation.webhook.pipeline.tekton.dev created
mutatingwebhookconfiguration.admissionregistration.k8s.io/webhook.pipeline.tekton.dev created
validatingwebhookconfiguration.admissionregistration.k8s.io/config.webhook.pipeline.tekton.dev created
clusterrole.rbac.authorization.k8s.io/tekton-aggregate-edit created
clusterrole.rbac.authorization.k8s.io/tekton-aggregate-view created
configmap/config-defaults created
configmap/feature-flags created
configmap/pipelines-info created
configmap/config-leader-election created
configmap/config-logging created
configmap/config-observability created
configmap/config-registry-cert created
configmap/config-spire created
deployment.apps/tekton-pipelines-controller created
service/tekton-pipelines-controller created
namespace/tekton-pipelines-resolvers created
clusterrole.rbac.authorization.k8s.io/tekton-pipelines-resolvers-resolution-request-updates created
role.rbac.authorization.k8s.io/tekton-pipelines-resolvers-namespace-rbac created
serviceaccount/tekton-pipelines-resolvers created
clusterrolebinding.rbac.authorization.k8s.io/tekton-pipelines-resolvers created
rolebinding.rbac.authorization.k8s.io/tekton-pipelines-resolvers-namespace-rbac created
configmap/bundleresolver-config created
configmap/cluster-resolver-config created
configmap/resolvers-feature-flags created
configmap/config-leader-election created
configmap/config-logging created
configmap/config-observability created
configmap/git-resolver-config created
configmap/hubresolver-config created
deployment.apps/tekton-pipelines-remote-resolvers created
horizontalpodautoscaler.autoscaling/tekton-pipelines-webhook created
deployment.apps/tekton-pipelines-webhook created
service/tekton-pipelines-webhook created
customresourcedefinition.apiextensions.k8s.io/batchpolls.devops.cloud.ibm.com created
customresourcedefinition.apiextensions.k8s.io/cryptodetectors.devops.cloud.ibm.com created
customresourcedefinition.apiextensions.k8s.io/pwtaskruns.devops.cloud.ibm.com created
customresourcedefinition.apiextensions.k8s.io/localpipelines.devops.cloud.ibm.com created
customresourcedefinition.apiextensions.k8s.io/workeragents.devops.cloud.ibm.com created
customresourcedefinition.apiextensions.k8s.io/pwaconfigs.devops.cloud.ibm.com created
customresourcedefinition.apiextensions.k8s.io/taskpayloads.devops.cloud.ibm.com created
customresourcedefinition.apiextensions.k8s.io/cdpipelineruns.devops.cloud.ibm.com created
customresourcedefinition.apiextensions.k8s.io/steplogs.devops.cloud.ibm.com created
configmap/private-worker-agent-config-defaults created
deployment.apps/private-worker-agent created
role.rbac.authorization.k8s.io/private-worker-agent created
rolebinding.rbac.authorization.k8s.io/private-worker-agent created
serviceaccount/private-worker-agent created
clusterrolebinding.rbac.authorization.k8s.io/pwa-manager-rolebinding created
clusterrole.rbac.authorization.k8s.io/manager-role created
clusterrolebinding.rbac.authorization.k8s.io/external-secret-update-role created
serviceaccount/external-secret-update-role created
job.batch/extsecret-install-1697655985441 created
namespace/tekton-chains created
secret/signing-secrets created
configmap/chains-config created
deployment.apps/tekton-chains-controller created
clusterrolebinding.rbac.authorization.k8s.io/tekton-chains-controller-cluster-access created
clusterrole.rbac.authorization.k8s.io/tekton-chains-controller-cluster-access created
clusterrole.rbac.authorization.k8s.io/tekton-chains-controller-tenant-access created
clusterrolebinding.rbac.authorization.k8s.io/tekton-chains-controller-tenant-access created
serviceaccount/tekton-chains-controller created
role.rbac.authorization.k8s.io/tekton-chains-leader-election created
rolebinding.rbac.authorization.k8s.io/tekton-chains-controller-leaderelection created
role.rbac.authorization.k8s.io/tekton-chains-info created
rolebinding.rbac.authorization.k8s.io/tekton-chains-info created
configmap/chains-info created
configmap/config-logging created
configmap/tekton-chains-config-observability created
service/tekton-chains-metrics created

다음으로 Tekton Chains에서 서명하는 데 사용되는 개인 및 공개 키 쌍을 설정해야 합니다. 자세한 정보는 Tekton Chains 문서 를 참조하십시오.

Tekton 체인 트리거

파이프라인에 대한 Tekton Chains를 트리거하려면 Tekton 작업 정의에 작업 결과를 추가하십시오. 두 개의 태스크 결과가 필요합니다.

• *_IMAGE_DIGEST 와 일치하는 이름이 있는
• *_IMAGE_URL 와 일치하는 이름이 있는

예를 들어, 다음과 같습니다.

...
   results:
    - name: APP_IMAGE_DIGEST
      description: The digest of the built image
    - name: APP_IMAGE_URL
      description: The url of the built image
...

태스크는 해당 스크립트 내에서 이 두 결과를 설정해야 합니다. Tekton Chains에서 사용되는 모든 메커니즘을 사용할 수도 있습니다.

이미지 레지스트리에 증명 푸시

기본적으로 Tekton Chains는 증명 및 서명을 oci 레지스트리에 저장하도록 구성됩니다. 기본 동작을 변경하려면 tekton-chains 네임스페이스에 있는 구성 맵 chains-config 를 편집하십시오. 자세한 정보는 Tekton Chains 문서 를 참조하십시오.

서명 확인

서명을 확인하기 위해 Chains Signal Provenance Tutorial 에 설명된 대로 cosign 를 사용할 수 있습니다.

관리 작업자에서 실행 중인 경우 개인용 작업자 엔드포인트 https://private-worker-service.{REGION}.devops.cloud.ibm.com/chains/public_key 를 사용하여 유효성 검증에 사용되는 공개 키를 검색할 수 있습니다. 이 엔드포인트에서 리턴된 컨텐츠를 파일에 저장하고 cosign 명령행에서 해당 파일을 공개 키로 사용할 수 있습니다.

서명 및 증명 다운로드

증명 또는 서명 자체를 가져오려면 download signature 또는 download attestation 명령과 함께 cosign 도구를 사용해야 합니다.