Hi, Lets understand about Helm Provenance and Integrity management.
It's a tool provided for the chart users to verify the integrity and origin of the package.
It uses the industry standard tools like PKI or GNUPG keys to verify whether the helm chart originated
from the authentic person or not. I can generate my own key or
Use the key provided by the organization and sign the package
When I'm making the package from the charts.
And once the package is done, it's going to generate the provenance file as well along with the package
And using that specific package, I should be in a position to verify whether the package is an authentic
package or not. Let me go ahead and create a sample chart.
I'm going to create a chart with the name helm create signchartdemo
A chart would get created. Before that, I need to have my own key.
The key either it can be generated or provided by the organization.
Most of the time, it will be provided by the organization specific to the project or specific to the
person. For demo purpose I am going to create my own key. So I'll use the command gpg--gen-key
This will give the option what kind of key I wanted to generate default is RSA
I will go with the default value and how many bids to use
I will go with the default value again.
And what should be the expiry of the key
I'll keep it as zero. That's the default. So that the key doesn't expire at all.
And it will ask for the confirmation whether I wanted to generate a key which doesn't expire. Yes.
The default is no so explicitly I have to provide Y
and what should be the name. So this will be the ID for this specific key.
Let me go ahead and give a name helmkeydemo, it will ask for the e-mail address and a comment to the key.
And it is going to use this specific key helmkeydemo and this specific e-mail address.
It will ask for the confirmation whether it's ok or needs to be changed.
I will give o for ok and it needs to have a passphrase to protect the key.
Let me go ahead and give the passphrase depending on the SSH tool that you are using automatically
this would get prompted. In case if you use putty, you may have to give this particular option along with the putty itself.
Let me give a passphrase, since it's a test mode I provided a shorter one.
It's giving a warning. Anyway, let me go ahead and proceed with the same passphrase.
Again, it's another warning. It doesn't have a digit. I'll go with the existing passphrase itself.
And need to re-enter the passphrase. Passphrase is nothing, but it's like a password
for the key that is getting generated, so it's going to generate the key.
And it'll provide the fingerprint and all the key will be stored in this specific location within the route.
It's going to have all the files I can list. Within the home page
It's going to have a folder .gnupg where it will be having all the keys stored and the keys
will be added as a part of the secring.gpg
This is what this will be used to sign that package.
Now we have generated the package and we do have the package. The package that we have over here is signchartdemo
Let me go ahead and package it. While packaging, I need to provide what is the key to be used to sign it.
And I can get the list of keys that are available within this particular system using the gpg command
gpg --list-secret-keys so I do have helmkeydemo over here and when it was created the other information.
I'm going to use this specific key and where the key ring is available that is the specific location and
the file name that is secring.gpg
I will provide while doing the packaging. Let me go ahead and do the packaging.
So the command is helm package --sign and use the key --key name of the key and where
the key ring is available. It's going to ask for the passphrase. It's like a password.
As I mentioned earlier, let me provide the passphrase and successfully it created the package.
If I look into this specific folder, I should have the actual package along with that I should
have another file with extension .prov which is going to be the provenance
file where this file should also get added along with the chart.
And this is what the file will be used to do the verification and where ever I'm going to add the chart
I need to add this particular package as well as this particular provenance file as well into the repository.
And once the file is downloaded I can verify using the command helm verify
So we completed the first part that is signing the package.
And I can add it into the repository.
The next part is how to do the verification.
Now, let me go ahead and do the verification helm verify and name of the package.
So that's going to give the information with what key it was signed and the fingerprint
In case if it is tampered with I'm going to have error message for the chart hash key. Here
I'm getting a confirmation saying chart hash verified.
Otherwise it will give an error message.
So in a quick summary we have seen how to use the gpg key to sign the package and how to leverage the
provenance and make sure the package that we are making is safe and secure
Also we saw how to use the verify command to verify the package.