Tekton chains by minmzzhang · Pull Request #132 · validatedpatterns/layered-zero-trust

minmzzhang · 2026-05-08T21:30:59Z

feat: integrate Tekton Chains with RHTAS keyless signing via SPIFFE

Add a tekton-chains Helm chart that configures Tekton Chains on OpenShift Pipelines for supply chain security with RHTAS keyless signing. A PostSync Job patches the operator-managed TektonConfig CR with chain configuration (Fulcio, Rekor, TUF, in-toto attestations) via oc patch, avoiding Tekton webhook conflicts with direct resource management.

Includes:

charts/tekton-chains: Helm chart with RBAC + PostSync patch Job
scripts/features/tekton-chains.yaml: feature variant fragment
Updated features.yaml: tekton-chains depends on pipelines + rhtas;
supply-chain now depends on tekton-chains
values-hub.yaml: commented-out application block at sync-wave 47
SYNC-WAVE-INVENTORY.md: updated deployment timeline and tables

p-rog

I added a few minor suggestions.

…ns chart Quote boolean Helm values (enableDeepInspection, transparency.enabled, signers.x509.fulcio.enabled) so they render as JSON strings, matching what TektonConfig chain spec expects. Add imagePullPolicy and resource requests/limits to the PostSync Job container for consistency with other pattern jobs. Signed-off-by: Min Zhang <minzhang@redhat.com>

mlorenzofr

I'm having errors with the tekton-chains-controller:

{
  "level": "warn",
  "ts": "2026-05-14T09:55:23.306Z",
  "logger": "watcher",
  "caller": "chains/signing.go:159",
  "msg": "No signer x509 configured for tekton",
  "commit": "bee7519eb20a587f8e063ff2016725970c1d1b7c",
  "knative.dev/controller": "github.com.tektoncd.chains.pkg.reconciler.taskrun.Reconciler",
  "knative.dev/kind": "tekton.dev.TaskRun",
  "knative.dev/traceid": "fe66ebf1-5a70-45fb-9a57-65736ac33545",
  "knative.dev/key": "layered-zero-trust-hub/qtodo-supply-chain-jvmlfo-restart-qtodo"
}
{
  "level": "warn",
  "ts": "2026-05-14T09:55:23.371Z",
  "logger": "watcher",
  "caller": "chains/signing.go:72",
  "msg": "error configuring x509 signer: no valid private key found, looked for: [x509.pem, cosign.key]",
  "commit": "bee7519eb20a587f8e063ff2016725970c1d1b7c",
  "knative.dev/controller": "github.com.tektoncd.chains.pkg.reconciler.pipelinerun.Reconciler",
  "knative.dev/kind": "tekton.dev.PipelineRun",
  "knative.dev/traceid": "cc052e13-5392-42f5-8c72-3e219382e676",
  "knative.dev/key": "layered-zero-trust-hub/qtodo-supply-chain-jvmlfo",
  "pipelinerun": "layered-zero-trust-hub/qtodo-supply-chain-jvmlfo"
}
{
  "level": "warn",
  "ts": "2026-05-14T09:55:23.374Z",
  "logger": "watcher",
  "caller": "chains/signing.go:159",
  "msg": "No signer x509 configured for tekton-pipeline-run",
  "commit": "bee7519eb20a587f8e063ff2016725970c1d1b7c",
  "knative.dev/controller": "github.com.tektoncd.chains.pkg.reconciler.pipelinerun.Reconciler",
  "knative.dev/kind": "tekton.dev.PipelineRun",
  "knative.dev/traceid": "cc052e13-5392-42f5-8c72-3e219382e676",
  "knative.dev/key": "layered-zero-trust-hub/qtodo-supply-chain-jvmlfo",
  "pipelinerun": "layered-zero-trust-hub/qtodo-supply-chain-jvmlfo"
}
{
  "level": "warn",
  "ts": "2026-05-14T10:47:06.406Z",
  "logger": "watcher",
  "caller": "chains/signing.go:72",
  "msg": "error configuring x509 signer: initialize tuf: creating cached local store: mkdir /.sigstore: read-only file system",
  "commit": "bee7519eb20a587f8e063ff2016725970c1d1b7c",
  "knative.dev/controller": "github.com.tektoncd.chains.pkg.reconciler.taskrun.Reconciler",
  "knative.dev/kind": "tekton.dev.TaskRun",
  "knative.dev/traceid": "21b9ad0a-0858-463d-87f5-fa4c66f4a736",
  "knative.dev/key": "layered-zero-trust-hub/qtodo-supply-chain-nn2yj0-qtodo-clone-repository"
}

where do we generate the x509 keypair?

Use direct TektonConfig resource with ServerSideApply (following sabre1041/spiffe-openshift pattern) instead of Job-based patching. Configures SPIFFE CSI volume, TUF cache, and env vars declaratively through the operator's options.deployments mechanism. Signed-off-by: Min Zhang <minzhang@redhat.com>

The ZTWIM operator hardcodes ignoreNamespaces: ["openshift-*"] in the spire-controller-manager config, which prevents SPIRE from issuing identities to pods in openshift-pipelines. Work around this by creating ClusterStaticEntry resources that register the tekton-chains-controller directly, bypassing the ignoreNamespaces filter. A PostSync Job dynamically discovers node UIDs to build the correct parentID for each SPIRE agent. Signed-off-by: Min Zhang <minzhang@redhat.com>

Restore commented-out placeholders (quay overrides, tekton-chains block) that were lost during the test branch merge. Update ose-cli image references to ose-cli-rhel9 in values-hub.yaml and scripts/features/. Signed-off-by: Min Zhang <minzhang@redhat.com>

The tekton-chains-spire-entries job needs to read the spire-controller-manager ConfigMap in the zero-trust-workload-identity-manager namespace to discover trust domain, cluster name, and class name. Without this Role/RoleBinding the job fails with Forbidden and no ClusterStaticEntries are created, leaving Tekton Chains unable to obtain a SPIFFE identity for x509 signing. Signed-off-by: Min Zhang <minzhang@redhat.com>

sabre1041

@minmzzhang This is really good! There are a few gotchas (see comments). However, after working through them, chains was able to complete successfully!

A quick update or 2 and we we should be good to integrate

The 256Mi limit caused OOMKilled on some clusters. Signed-off-by: Min Zhang <minzhang@redhat.com>

sabre1041

LGTM!

minmzzhang requested review from mlorenzofr, p-rog and sabre1041 and removed request for sabre1041 May 8, 2026 21:38