Flux CD
Hard
Security
How can you make Flux refuse an OCI artifact that wasn't signed by your CI pipeline?
Select your answer:
Show answer and explanation
Answer: Set spec.verify on the OCIRepository with provider cosign or notation
Explanation
With spec.verify, source-controller checks the Cosign or Notation signature before it produces an artifact, so no Kustomization or HelmRelease sees unsigned content. For keyless Cosign signatures from CI, matchOIDCIdentity pins the expected issuer and subject.
More hard Flux CD questions
- Which GitRepository setting makes Flux check that the tag it checks out was signed with a trusted PGP key?
- One kustomize-controller can't keep up with thousands of Kustomizations. How does Flux split the work?
- What does 'flux reconcile kustomization my-app' change on the object to trigger a reconciliation?
- A ConfigMap applied by a Flux Kustomization holds a shell script using ${HOME}, and postBuild substitution blanks it out. What stops that?
- A HelmRelease in flux-system sets targetNamespace: apps and no storageNamespace. Where does Helm keep the release's storage Secrets?
- How can an OCIRepository authenticate to Amazon ECR without a static registry password?