Harry Tang

Signing Commits with FluxCD for Image Update Automation

FluxCD Signed Commits
FluxCD Signed Commits

Introduction

By default, the Image Update Automation of FluxCD will make commits to the configured repository without signing. In this article, I will show you how to configure the signing key for FluxCD to use when signing the commits (GitHub).

Prerequisites

  • A K8s cluster.
  • Flux System installed. See this article.
  • Sealed secrets installed.
  • A GitHub account.

Step-by-step Guide

  1. Generate the GPG key:

    gpg --full-generate-key

    Use your GitHub username and email, select the default key type, set the key size to 4096, and choose no expiration.

  2. Export the GPG key:

    To save the GPG keys in the current folder:

    gpg --armor --output pub.asc --export [email protected]
gpg --armor --output git.asc --export-secret-keys [email protected]

  3. Add the public GPG key to GitHub:

    Follow this document to add the GPG key to your Github account.

  4. Create the secret for the signing key:

    kubectl create secret generic --dry-run=client \
  fluxcd-signing-key \
  --namespace=your_name_space \
  --from-file=git.asc \
  -o yaml | kubeseal --format=yaml > signing-key.sealed-secret.yaml

  5. Create the ImageUpdateAutomation:

    I use mrgitops as the GitHub username and [email protected] as the GitHub email for the ImageUpdateAutomation in the default namespace. Feel free to adjust these to suit your requirements.

    apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageUpdateAutomation
metadata:
  name: default
  namespace: default
spec:
  interval: 1m0s
  sourceRef:
    kind: GitRepository
    name: flux-system
    namespace: flux-system
  git:
    checkout:
      ref:
        branch: main
    commit:
      author:
        email: [email protected]
        name: mrgitops
      signingKey:
        secretRef:
          name: fluxcd-signing-key
      messageTemplate: '{{range .Updated.Images}}{{println .}}{{end}}'
    push:
      branch: main
  update:
    path: ./clusters/pi/default
    strategy: Setters

Conclusion

You've configured the signing key for FluxCD Image Update Automation, enhancing your professionalism.

References

Comments