Skip to content
This repository was archived by the owner on Nov 30, 2021. It is now read-only.

Commit cf66fdf

Browse files
author
Vaughn Dice
committed
docs(*): add doc on signed helm charts
As well as self-hosted public key used to sign charts.
1 parent 57b3eb8 commit cf66fdf

File tree

7 files changed

+157
-0
lines changed

7 files changed

+157
-0
lines changed

‎mkdocs.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ pages:
3232
- Configuring Object Storage: installing-workflow/configuring-object-storage.md
3333
- Configuring Postgres: installing-workflow/configuring-postgres.md
3434
- Configuring the Registry: installing-workflow/configuring-registry.md
35+
- Workflow Helm Charts: installing-workflow/workflow-helm-charts.md
3536
- Users:
3637
- Command Line Interface: users/cli.md
3738
- Users and Registration: users/registration.md

‎src/installing-workflow/index.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,8 @@ $ helmc install workflow-v2.8.0 # injects resources into
8383

8484
$ helm install deis/workflow --version=v2.8.0 --namespace=deis -f <optional values file> # injects resources into your cluster
8585

86+
See also our section on [Workflow chart provenance](workflow-helm-charts.md#chart-provenance)
87+
8688
Helm Classic will install a variety of Kubernetes resources in the `deis` namespace.
8789
Wait for the pods that Helm Classic launched to be ready. Monitor their status by running:
8890

‎src/installing-workflow/workflow-helm-charts.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Workflow Helm charts
2+
3+
As of Workflow [v2.8.0](../changelogs/v2.8.0.md), Deis has released [Kubernetes Helm][helm] charts for Workflow
4+
and for each of its [components](../understanding-workflow/components.md).
5+
6+
## Installation
7+
8+
Once [Helm][helm] is installed and its server component is running on a Kubernetes cluster, one may install Workflow with the following steps:
9+
```
10+
$ helm repo add deis https://charts.deis.com/workflow # add the workflow charts repo
11+
12+
$ helm install deis/workflow --version=v2.8.0 --namespace=deis -f <optional values file> # injects resources into your cluster
13+
```
14+
15+
## Chart Provenance
16+
17+
Helm provides tools for establishing and verifying chart integrity. (For an overview, see the [Provenance](https://github.com/kubernetes/helm/blob/master/docs/provenance.md) doc.) All release charts from the Deis Workflow team are now signed using this mechanism.
18+
19+
The full `Deis, Inc. (Helm chart signing key) <[email protected]>` public key can be found [here](../security/1d6a97d0.txt), as well as the [pgp.mit.edu](http://pgp.mit.edu/pks/lookup?op=vindex&fingerprint=on&search=0x17E526B51D6A97D0) keyserver and the official Deis Keybase [account][deis-keybase]. The key's fingerprint can be cross-checked against all of these sources.
20+
21+
### Verifying a signed chart
22+
23+
The public key mentioned above must exist in a local keyring before a signed chart can be verified.
24+
25+
To add it to the default `~/.gnupg/pubring.gpg` keyring, any of the following commands will work:
26+
27+
```
28+
$ # via our hosted location
29+
$ curl https://deis.com/workflow/docs/security/1d6a97d0.txt | gpg --import
30+
31+
$ # via the pgp.mit.edu keyserver
32+
$ gpg --keyserver pgp.mit.edu --recv-keys 1D6A97D0
33+
34+
$ # via Keybase with account...
35+
$ keybase follow deis
36+
$ keybase pgp pull
37+
38+
$ # via Keybase by curl
39+
$ curl https://keybase.io/deis/key.asc | gpg --import
40+
```
41+
42+
Charts signed with this key can then be verified at install time:
43+
44+
```
45+
$ helm repo add deis https://charts.deis.com/workflow
46+
$ helm install --verify deis/workflow --namespace deis
47+
48+
$ helm repo add router https://charts.deis.com/router
49+
$ helm install --verify router/router --namespace deis
50+
$ # etc.
51+
```
52+
53+
Having done so, one is assured of the origin and authenticity of any installed Workflow chart released by Deis.
54+
55+
[helm]: https://github.com/kubernetes/helm/blob/master/docs/install.md
56+
[deis-keybase]: https://keybase.io/deis

‎src/quickstart/provider/aws/install-aws.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ $ helmc install workflow-v2.8.0 # injects resources into
6060

6161
$ helm install deis/workflow --version=v2.8.0 --namespace=deis -f <optional values file> # injects resources into your cluster
6262

63+
See also our section on [Workflow chart provenance](../../../installing-workflow/workflow-helm-charts.md#chart-provenance)
64+
6365
Helm Classic will install a variety of Kubernetes resources in the `deis` namespace.
6466
You'll need to wait for the pods that it launched to be ready. Monitor their status
6567
by running:

‎src/quickstart/provider/gke/install-gke.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ $ helmc install workflow-v2.8.0 # injects resources into
5555

5656
$ helm install deis/workflow --version=v2.8.0 --namespace=deis -f <optional values file> # injects resources into your cluster
5757

58+
See also our section on [Workflow chart provenance](../../../installing-workflow/workflow-helm-charts.md#chart-provenance)
59+
5860
Helm Classic will install a variety of Kubernetes resources in the `deis` namespace.
5961
You'll need to wait for the pods that it launched to be ready. Monitor their status
6062
by running:

‎src/quickstart/provider/vagrant/install-vagrant.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ $ helmc install workflow-v2.8.0 # injects resources into
5555

5656
$ helm install deis/workflow --version=v2.8.0 --namespace=deis -f <optional values file> # injects resources into your cluster
5757

58+
See also our section on [Workflow chart provenance](../../../installing-workflow/workflow-helm-charts.md#chart-provenance)
59+
5860
Helm will install a variety of Kubernetes resources in the `deis` namespace.
5961
You'll need to wait for the pods that it launched to be ready. Monitor their status
6062
by running:

‎src/security/1d6a97d0.txt

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
sec 4096R/1D6A97D0 2016-11-03
2+
Key fingerprint = 41AF 6B6A 9489 9B58 1EB6 9ED1 17E5 26B5 1D6A 97D0
3+
uid Deis, Inc. (Helm chart signing key) <[email protected]>
4+
ssb 4096R/2CA931B0 2016-11-03
5+
ssb 4096R/41C9CA1E 2016-11-03 [expires: 2024-11-01]
6+
7+
-----BEGIN PGP PUBLIC KEY BLOCK-----
8+
Version: GnuPG v2
9+
10+
mQINBFgbpCIBEACeZsh7wsilg+gAGPUrL3u0YUO66qWPP2fjj72MYbv8Cmqd8lEf
11+
t7uC7+foUhEtnS2Y+xxjNlEtPi3etE6wheGJdIhHunWQKarU/tZtuh1bkPrVeLdT
12+
aXslefS9SXWTHxqHZESJyJR1bFNrFBdND1rmTNqYi3Bkh22sgcmSsb+GgWly8JzI
13+
qphl9xg26VuAgMJ8IsILgNbi6CvgmBzFZqVgYU/gtR8cD6VDSCBKnFm9eFzBu39q
14+
nIa6Hdtf/MsspgyrcYfPTjt6/77FNtC3ThI361zSxVtUBBdOF4Dutwsl5QfdFryA
15+
hOY9ix7kNerLIXNturmLqoXLiszlpJL/yC9TGNzbi553T+JDCdK/qzfOsrcmAWhd
16+
L7txnGwSs5KkzVnknZw2c65UGrKheFlT2LjZrtTBZ3ZLJ9n6KvRUOqTwNs6/oKCb
17+
hPyq1nUIO8l8LstKJmlW8tTSceVvsYJV1jNwSFNPlNWW0mgRB2v2wUNpPToSTsFP
18+
bzwjnsOOVezbOoUnq02SIWXO7dCC0S8v5wZaRPmUN3xEEd129GHI8/LW7qdxpimh
19+
npbgUShB3zuA8N/X0VGkw3OfWdzS0beeQbSgVtxYDM6/2TIf4Hx9aDsKkRZe8aIk
20+
LhF6+zUEjr3oMjcFWVXKxYJSRc9KsXtsJr+RF6qC59phmLkZtTHk4k+aAQARAQAB
21+
tDdEZWlzLCBJbmMuIChIZWxtIGNoYXJ0IHNpZ25pbmcga2V5KSA8c2VjdXJpdHlA
22+
ZGVpcy5jb20+iQI5BBMBCAAjBQJYG6QiAhsDBwsJCAcDAgEGFQgCCQoLBBYCAwEC
23+
HgECF4AACgkQF+UmtR1ql9CeFw//WPlST2zv3TaZ5b+khWp3vv61yRiUH35Dq6uH
24+
4oCHLCr/H7pEJX1KE/AXJzFyTrQV+VZVzgIjyNZqyKd6s8Ny4zfXVwCLPAh9Qnfz
25+
deb8WHXdXxNta69egeiGAKpjJh5H9LOMHwfKL1L60d+TmlCPkg5Se9YMW4cPikYp
26+
6qspIOa90xrF3slzvbnp2cYV02R7BMPgEMHRkmZDLXQ0ckEGRV+KV42vzB04OiBf
27+
A9GpLmVn1n8v45Wo9akGQvpOg1Z9RQC/+wiRjy60TtHZm+G03Z5cel0f2J3Pb3TB
28+
xBjVo7s7DedddxAHlEBNLZPrxIGig8fWwWsILow/s16bfRSP+Qoo+rTaQkTkh/1m
29+
6mYrnji/SRwafZ1gRcBYwUyiAv7rEsINOr5DEI6S+pTuTKl+hdA0SgvSGwQ3fCTJ
30+
YQxghdK/dsZn80dxZj2xBApHd7NxuvPl94hIiYjEF3OeCZio/El5a3Aj+C83JSkv
31+
KOPd7S8fakQBuCAD0QqPSGXuv0gFXwiodqjjpePpZhIcuqvPWT7rkxJewJgIUBlY
32+
0AL8rUdHZa4zMI+eGD6FX22VrutpTciaX786CN/5jlVDxIKCZASHkHn6rprOZo9b
33+
1+3a9Xe0K+NpZ62F28A/nhQ+e2SB0n1SI/0J4N9BO866i5RybFyKhLWaeLCWm37J
34+
j9PoHMm5Ag0EWBukIgEQALr3f5QBpNQUoqEtWwewR4hXrk66zR+sBpcspunldB6a
35+
avUCFFCoUS7tbnlOeA4i5LFX8IZ8UXKz2wLpCWwuAqjwTA3YzI6KGwLao7lg18le
36+
nomTThwDbOBrZ/tmMsh71310SGhnpwNaDr0jzH1XduzvljpP7tZNcIAyQOqfWaES
37+
74qmGb4LfTofjbpKrg0zPh1P08VXcR8bjFSNf4M/Vlprb27US/ExPn8Fgpf7ddgo
38+
L0rTG6cVxAbwM1KThRhM0zopQcl9owA9aulXEx0bb5VAfAyjG86QVhUOYpKccDYm
39+
1PdLqAxXLZGWOsU/miDlTjWY4CbC0HZPAK4yyABafgdWf0sRBv6sAXtElu3zOQqy
40+
pIBaQdq5HomseOqrb5HZs1TFz7fGDLsbT6E2CJHbMM5xUhdDwr3OlWLkJjn6mAkQ
41+
Z0VWYjYyMAuvHIAdJZ6OwRcaJ1xKKc1GMEujeyColVVdKEGSE31ROvDZaR+zUM1m
42+
2YGK+XYHXO6nJyHjcvQ3Uh1dCnqeQvgIFyUwLQi+FwEeYgc86BPzeK8ouIjPHQY0
43+
MinmSJv/kbHJn4DhsdaIdQVMhgDVOWwBfJS8+osDrU/Js2j+kiq/BjPV3gXuctOM
44+
aJYWMPNgMTLx0ROrso5wU7NHsQUVCN5Qv+6iJjpaHr9aQu2YuUO7eONtAD35B2MZ
45+
ABEBAAGJAh8EGAEIAAkFAlgbpCICGwwACgkQF+UmtR1ql9ByLA/+JRYLt8uioAzd
46+
ySBFap/w7ntNq7A6cOU2zmHt0AA9JX3NT2r4tfmIE54CNH8WxjAnnXsr13tdOPoN
47+
bbg2cdKYEdK6xaOg84kqrNiZ2+n93ll5I2Puhh2/eip8EiWURnPfKtM6PX7o6cPS
48+
EDZ8EyJ9lDSwUfIiMg8sNEv8OBKq3prl9b4B7JzLr9QLE/S9ek5z4mri6MBXwb/I
49+
+XKuY/YTQswRX7os7XRk8MbQuppRLfyTXH9aM5AwNMZXmU5MIK5Gu4sv41wGUIzu
50+
4GqeGVOmLFUnYUE/rNNZFH1HEAQj9QH6DqCqkgDLUNMQUGaWZRmmgHRZRyfCLkM0
51+
f/wVIGiCPuMF0vxqAVA/QQVPn92Ul1SmznNjAf9nnjZwKC+ubEIQ7cXphkNJAql9
52+
ccNRIdGxhEQzjzRnySkxHQsWw8Ly2Bwz/NzumPzkoNZ1a3X7dHVeKaYo/HIUMAph
53+
Um4N5yBvXSiZY8/94FfDVSstXGqt3kZhK82h2yvqiHIpUcFMxNLFpTXcdzRHrSnN
54+
ATzk/4Au1krHIj1KcxyjXYt2M+alXkSsLyK8nf3vrPX+zzbB1ZQwKPohPwmKCFFj
55+
u9fo6JM921U98SuWduRe5u0pU7ZBQB9NPsSrXSz8mZ5lfPJP90sKxFYBHDN6bSaD
56+
G5d76sWHAg/xaw8kfPNc0GSbtudOFGm5Ag0EWBukpAEQAKRxaVOfurtp9ZK9kBQf
57+
dlAUz7I18OCtGS01rPM64kvSdIOB91sjPDiDs81C6nX/Bqso8QM112Ms9PLeTANy
58+
Rs2BhnwprG1BMqCFUyykzrR2Fpkq3C0aqLMLId8SVisCasOxi5w3CjvEulfqDeZN
59+
e7dA+/sFwNryU8q65eQTd43JOQZtX0xrdfv/RQkSgsLlQb7txIcPayM87yWzIn6U
60+
pBvwaMV6K4Puq7LCNsNt/vF62xUhttjlv0De23THkeiieOBtS0cL8Wmp1XtilNpF
61+
BzwjaKl/tP9G+/TJr3jx8G02nvR9/STXxW6SUb9su5reRmP5Jk42tRTVI857xX6j
62+
oOmGtbec8tbEBzOoCBHOOGK+FqjHT1FiPn6EY8BGnqFy0ArBuEGyvpw/X2QZC03D
63+
tIl6k3vj8Lz8X2ucCWwzqTZJ+/IKaA6HBF5glWl8U3aNspCi+SnPsTJVQ9cQtxdc
64+
DLzRXXmyb6q1LZlpig+wWqr6LqLTtjgeGRh64mKNVUkSDT108B9mplRA6HYjZQw9
65+
YbWAs6EQFfDesObhjVjhdDKsU7dri1nVtbzdVEOPN6Rz4Uogzr8flYLchgkHyBJG
66+
EO9bYzqeu7F2vFzZmTaWimai8xqyXliClBTZwUB3LfujDpWbNteNA7LaPYk1DNsY
67+
mOpY9UWPRlpBQXCGINDyCpQrABEBAAGJBEQEGAEIAA8FAlgbpKQCGwIFCQ8JnAAC
68+
KQkQF+UmtR1ql9DBXSAEGQEIAAYFAlgbpKQACgkQJ8N4N0HJyh6JkA//cshmimC/
69+
8z+wepXIyTkphlvtmxHUoJHReqoWM4ofN542M3Txyr3UouBdE8sYtIx30DXVu12F
70+
WJjLPXXYD/mENpmvRP+0ScbKcKYnVK8A2vmtCl5GBRkIKN3qqEUUGPWeWfzpAZOH
71+
rw+f0/EdpzRxQqDdXtKUO2CM6k2ao5k7KVcGLq2aI6zr80EsyPc+nOx4k7IQBuPz
72+
lRvlFK3QQVL4F8SqrOcbuYClaUGcx0YoL6tY6uTrZvVDzsr71h2IfgzyoxWLyzuo
73+
FB/wABHUhnAJQB0T6kv89xUOogpK6dgGCDHbq2P7jDdbCbLgjKwMYbG780M0KKud
74+
2eAJg2pSRgQxcVbdKS4CSXBCfmRXVJuHPDhi9BXrUMcYqUPCpicXhNgKd0EdOu22
75+
exKrL7a3Tpz0pHLiRTrUU4zEvZEASQJzaaL3Qvf62m0PR4STb0wmGJ40DxrwFmWp
76+
pDA2k7VPAf3LST4YGt9ytwG372oF/02NclrXRah8DeJkokjxHA9vuY3mm2MqYccu
77+
qL9aSM8qmutpnxVEIFhOZWtmxN6WNsAK37/T59LIdnBX3UA787ydztSHJm2L8EPN
78+
g4jTKAzeVGTQzd2fbIxPidqQCZn5btkjpFvwE6nH5RVojhvipgFf4udsWxPPMSmU
79+
/ezoPxrWps08CqWPG2qPJL+sV3A6P5NwdbBfCw//YnHF5fa2azPSjIKBrftpCoyC
80+
mSJnxOj23Kk9gD7w/a/D+ODxNyxzRjFs/xpceJZi0SIcbKw+9rOPYsrunH27abxb
81+
IPXgvSFLNTbLx9jcSXaW+fkNdlDYEZcWhqTHDyRau9BoXdgSm2nY3luMAkxMIQAC
82+
m2HvHsB63fIxSEPRM0QEmi7yBk3f2QyUPvus7IcgEidbSmEpZxaOY8D79nzgfgh/
83+
WzggxpvZPdT664s6nhTLGxp2UD6wAlA2lSkIWrCPB3ZT5p58KcIBULtpb6mN5rWs
84+
D0UEEEMOMIwWlBqgDyrYylemPMks9GuMC1X7ANsbpjhwxjikyMLFFUBHa301CpHy
85+
k2fqCwvhidCoz8Y9e5V1sUSuoHtHeiikK7chUTDBH6no6bUT+8JZNScqw8jYV9cD
86+
4F01NhHO5OAuECIf0IszwslD6t1jVdTbwVL7hrRATDPMtxsPsFir8sPrT2EAk0MV
87+
lM1wNw60FMVgl23ok88EH02Q8a0Vp/P3zzMzK3Vj0DqcERpWIm+QR4wJhQnC397K
88+
o4Z4WknuB0oPZqVqgJzi8j5JTW8phgT/0rxFj1KA1yBiwudJBaRofQNQqK3NSYWe
89+
VB/69T2Srvd3e4V7dtSLuWI/JGjoIoC8TTK+OsDC4RN3w+5mYyfBwAZCABRrTXB+
90+
K8I9jWQf2UCagoUuV3w=
91+
=qap/
92+
-----END PGP PUBLIC KEY BLOCK-----

0 commit comments

Comments
 (0)