One post tagged with "cosign"

GitOps helps us declare our desired workloads, but how do we deal with and manage secrets? Additionally, as our fleet grows, we also blend artifacts and configuration from many different sources. How do we trust what we are running?

OpenBao is an open source secrets and encryption platform under the OpenSSF. In this post we'll integrate OpenBao with Flux in two ways:

• kustomize-controller will decrypt SOPS-encrypted Secrets through OpenBao using workload identity, with no static BAO_TOKEN or VAULT_TOKEN to bootstrap
• Cosign will sign OCI artifacts with a key held within OpenBao, producing signatures Flux can verify without any service outside your infrastructure

For both integrations, we'll use two OpenBao features. The Transit secrets engine performs encrypt, decrypt, and sign operations without ever releasing the key material, acting as a Key Management System (KMS), and the Kubernetes and JWT auth methods let a workload trade its Kubernetes-issued ServiceAccount token for a short-lived OpenBao token, so no long-lived credential has to exist on either the OpenBao or Kubernetes side.