sigstore-scaffold

Sigstore

Chainguard's redistribution of the Sigstore Helm charts, pre-configured with hardened Chainguard Images.

This module contains seven charts: sigstore-scaffold, sigstore-ctlog, sigstore-fulcio, sigstore-rekor, sigstore-trillian, sigstore-tsa, and sigstore-tuf.

Prerequisites

Authentication is required to access these charts and their images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace sigstore

Installation

The sigstore-scaffold chart is the umbrella chart that deploys all components together:

helm install sigstore oci://cgr.dev/ORGANIZATION/charts/sigstore-scaffold \
  --namespace sigstore \
  --create-namespace \
  --set fulcio.imagePullSecrets[0].name=cgr-pull-secret \
  --set ctlog.imagePullSecrets[0].name=cgr-pull-secret \
  --set rekor.imagePullSecrets[0].name=cgr-pull-secret \
  --set trillian.imagePullSecrets[0].name=cgr-pull-secret

Individual sub-charts can also be installed separately:

helm install trillian oci://cgr.dev/ORGANIZATION/charts/sigstore-trillian \
  --namespace trillian-system \
  --create-namespace \
  --set imagePullSecrets[0].name=cgr-pull-secret

About These Charts

These are redistributions of the upstream Sigstore Helm charts. All upstream configuration options and documentation apply.

For full documentation, see: https://docs.sigstore.dev/