Batuhan Apaydın developer-guy

Keybase proof

I hereby claim:

I am developer-guy on github.
I am developerguy (https://keybase.io/developerguy) on keybase.
I have a public key ASBH5MyQO5bJeRxfCQiXt6BXvQ9pz6lIJ8i8XdLEStuZnQo

To claim this, I am signing this object:

Experimental Keyless Cosign verify-blob command to verify the signature that is exported by the skopeo tool to the directory

Let's assume that we have an image called devopps/busybox:glibc, we gain this image by copying the real busybox:glibc image from DockerHub by issuing the following command:

$ crane copy busybox:glibc devopps/busybox:glibc

crane is a tool for interacting with remote images and registries. https://github.com/google/go-containerregistry/tree/main/cmd/crane

	package main

	import (
	"errors"
	"fmt"
	"github.com/google/go-containerregistry/pkg/authn"
	"github.com/google/go-containerregistry/pkg/name"
	"github.com/google/go-containerregistry/pkg/v1/empty"
	"github.com/google/go-containerregistry/pkg/v1/mutate"
	"github.com/google/go-containerregistry/pkg/v1/remote"

	apiVersion: v1
	kind: Pod
	metadata:
	name: your-webhook
	namespace: platform
	spec:
	volumes:
	- name: tls-volume
	secret:
	defaultMode: 420

	apiVersion: cert-manager.io/v1
	kind: Issuer
	metadata:
	name: vault-issuer
	namespace: platform
	spec:
	vault:
	server: http://vault.default:8200
	path: pki/sign/config-admission-webhook
	auth:

	apiVersion: cert-manager.io/v1
	kind: Certificate
	metadata:
	name: config-sidecar-injector-service
	namespace: platform
	spec:
	secretName: config-admission-webhook-tls
	issuerRef:
	name: vault-issuer
	dnsNames:

	$ helm repo add hashicorp https://helm.releases.hashicorp.com
	$ helm repo update
	$ helm upgrade --install vault hashicorp/vault \
	--set "injector.enabled=false" \
	--set "server.dev.enabled=true"

	# Vault provides a Kubernetes authentication method that enables clients to authenticate with a Kubernetes Service Account Token.
	# Enable the Kubernetes authentication method.
	$ vault auth enable kubernetes
	Success! Enabled kubernetes auth method at: kubernetes/

	# Configure the Kubernetes authentication method to use location of the Kubernetes API, the service account token, its certificate, and the name of Kubernetes' service account issuer (required with Kubernetes 1.21+).
	$ vault write auth/kubernetes/config \
	kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
	token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
	kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \

	# Enable the PKI secrets engine at its default path.
	$ vault secrets enable pki
	Success! Enabled the pki secrets engine at: pki/

	# By default the KPI secrets engine sets the time-to-live (TTL) to 30 days. A certificate can have its lease extended to ensure certificate rotation on a yearly basis (8760h).
	# Configure the max lease time-to-live (TTL) to 8760h.
	$ vault secrets tune -max-lease-ttl=8760h pki
	Success! Tuned the secrets engine at: pki/

	# Vault can accept an existing key pair, or it can generate its own self-signed root. In general, we recommend maintaining your root CA outside of Vault and providing Vault a signed intermediate CA.