Signing Commits with FluxCD for Image Update Automation

FluxCD Signed Commits
FluxCD Signed Commits

Introduction

By default, the Image Update Automation of FluxCD will make commits to the configured repository without signing. In this article, I will show you how to configure the signing key for FluxCD to use when signing the commits (GitHub).

Prerequisites

  • A K8s cluster.
  • Flux System installed. See this article.
  • Sealed secrets installed.
  • A GitHub account.

Step-by-step Guide

  1. Generate the GPG key:

    gpg --full-generate-key
    

    Use your GitHub username and email, select the default key type, set the key size to 4096, and choose no expiration.

  2. Export the GPG key:

    To save the GPG keys in the current folder:

    gpg --armor --output pub.asc --export [email protected]
    gpg --armor --output git.asc --export-secret-keys [email protected]
    
  3. Add the public GPG key to GitHub:

    Follow this document to add the GPG key to your Github account.

  4. Create the secret for the signing key:

    kubectl create secret generic --dry-run=client \
      fluxcd-signing-key \
      --namespace=your_name_space \
      --from-file=git.asc \
      -o yaml | kubeseal --format=yaml > signing-key.sealed-secret.yaml
    
  5. Create the ImageUpdateAutomation:

    I use mrgitops as the GitHub username and [email protected] as the GitHub email for the ImageUpdateAutomation in the default namespace. Feel free to adjust these to suit your requirements.

    apiVersion: image.toolkit.fluxcd.io/v1beta2
    kind: ImageUpdateAutomation
    metadata:
      name: default
      namespace: default
    spec:
      interval: 1m0s
      sourceRef:
        kind: GitRepository
        name: flux-system
        namespace: flux-system
      git:
        checkout:
          ref:
            branch: main
        commit:
          author:
            email: [email protected]
            name: mrgitops
          signingKey:
            secretRef:
              name: fluxcd-signing-key
          messageTemplate: '{{range .Updated.Images}}{{println .}}{{end}}'
        push:
          branch: main
      update:
        path: ./clusters/pi/default
        strategy: Setters    
    

Conclusion

You've configured the signing key for FluxCD Image Update Automation, enhancing your professionalism.

References

Comments