Skip to content
/ chains Public
forked from tektoncd/chains

Supply Chain Security in Tekton Pipelines

License

Notifications You must be signed in to change notification settings

jkhelil/chains

This branch is 5 commits ahead of, 66 commits behind tektoncd/chains:main.

Folders and files

NameName
Last commit message
Last commit date

Latest commit

ec6f94a · Jan 16, 2025
Sep 16, 2024
Jul 29, 2024
May 17, 2024
Aug 12, 2024
Jun 5, 2024
May 23, 2023
Oct 12, 2023
Apr 26, 2023
Jan 16, 2025
Nov 1, 2023
Jul 30, 2024
Dec 18, 2024
Jun 17, 2020
Dec 14, 2021
May 14, 2024
Sep 26, 2024
Jun 15, 2020
Jan 28, 2022
Jun 15, 2020
Feb 29, 2024
Oct 25, 2023
Jul 9, 2021
Jun 15, 2020
Dec 18, 2024
Dec 18, 2024
Jun 10, 2024
Jul 27, 2021
Jun 1, 2021

Repository files navigation

Tekton Chains

CII Best Practices

Supply Chain Security in Tekton Pipelines

Tekton Chains logo

Getting Started

Tekton Chains is a Kubernetes Custom Resource Definition (CRD) controller that allows you to manage your supply chain security in Tekton.

In its default mode of operation, Chains works by observing all TaskRuns executions in your cluster. When TaskRuns complete, Chains takes a snapshot of them. Chains then converts this snapshot to one or more standard payload formats, signs them and stores them somewhere.

Current features include:

  • Signing TaskRun results with user provided cryptographic keys, including TaskRuns themselves and OCI Images
  • Attestation formats like intoto
  • Signing with a variety of cryptographic key types and services (x509, KMS)
  • Support for multiple storage backends for signatures

Installation

Prerequisite: you'll need Tekton Pipelines installed on your cluster before you install Chains.

To install the latest version of Chains to your Kubernetes cluster, run:

kubectl apply --filename https://storage.googleapis.com/tekton-releases/chains/latest/release.yaml

To install a specific version of Chains, run:

kubectl apply -f https://storage.googleapis.com/tekton-releases/chains/previous/${VERSION}/release.yaml

To verify that installation was successful, wait until all Pods have Status Running:

kubectl get po -n tekton-chains --watch
NAME                                       READY   STATUS      RESTARTS   AGE
tekton-chains-controller-c4f7c57c4-nrjb2   1/1     Running     0          160m

Setup

To finish setting up Chains, please complete the following steps:

Vendor specific documentation

Any additional documentation specific to particular cloud vendors can be found at docs/vendor.

Tutorials

To get started with Chains, try out our getting started tutorial.

To start signing OCI images and generating signed provenance for them, try our signed provenance tutorial.

Community tutorials

The Chains community has been hard at work creating tutorials as well:

Experimental Features

To learn more about experimental features, check out experimental.md

Want to contribute

We are so excited to have you!

  • See CONTRIBUTING.md for an overview of our processes
  • See DEVELOPMENT.md for how to get started
  • See ROADMAP.md for the current roadmap Check out our good first issues and our help wanted issues to get started!
  • See releases.md for our release cadence and processes

To learn more about Chains:

  • Chat with us in the #chains Slack channel
  • Attend the Chains Working Group meeting, details here

About

Supply Chain Security in Tekton Pipelines

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Go 98.5%
  • Shell 1.5%