Key rotation
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 277
- Forks
- 164
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 61
Description
Hello, does tekton chains support rotation of the keys used to sign artifacts, pipelineRuns, taskRuns etc?
The scenario we have is where we are using chains with hashicorp vault and ideally we'd like to sign with keys that are rotated either for every pipelineRun, or once a day, week etc.
We have discussed looking at a mechanism to delete the key to force generation of a new one, however we have mutliple pipelines running in parallel and see we can't be certain that a key is "finished with" unless we halt all running pipelines to perform the rotation ourselves.
I can't find any documentation on this, so thought I'd ask here.
Thanks,
Matt
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the existing documentation for Tekton Chains key generation and its HashiCorp Vault integration. Determine whether rotation is supported and how concurrent PipelineRuns affect key lifecycle. Done should document the supported rotation behavior or define a safe rotation mechanism for parallel runs.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100