{"componentChunkName":"component---node-modules-gatsby-theme-apollo-docs-src-components-template-js","path":"/security/supply-chain/","result":{"data":{"site":{"pathPrefix":"","siteMetadata":{"title":"akv2k8s docs","description":"How to get Azure Key Vault objects into Kubernetes"}},"file":{"childMarkdownRemark":{"frontmatter":{"title":"Supply chain verification","description":"Verify akv2k8s release images, attestations, and SBOMs"},"headings":[{"value":"Verify Image Attestations"},{"value":"Download Attestation Bundles"},{"value":"SBOM Assets"}],"fields":{"image":"social-cards/supply-chain.png","graphManagerUrl":""},"htmlAst":{"type":"root","children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"akv2k8s release workflows publish container images with GitHub artifact attestations and SBOM assets. Use these artifacts to verify that an image was produced by the akv2k8s release workflow before deploying it."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{"id":"verify-image-attestations","style":"position:relative;"},"children":[{"type":"element","tagName":"a","properties":{"href":"#verify-image-attestations","ariaLabel":"verify image attestations permalink","className":["anchor","before"]},"children":[{"type":"element","tagName":"svg","properties":{"ariaHidden":"true","focusable":"false","height":"16","version":"1.1","viewBox":"0 0 16 16","width":"16"},"children":[{"type":"element","tagName":"path","properties":{"fillRule":"evenodd","d":"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"},"children":[]}]}]},{"type":"text","value":"Verify Image Attestations"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Use the GitHub CLI to verify a released image attestation:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"bash"},"children":[{"type":"element","tagName":"pre","properties":{"style":"counter-reset: linenumber NaN","className":["language-bash","line-numbers"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-bash"]},"children":[{"type":"text","value":"gh attestation verify "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n  "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"oci://docker.io/spvest/azure-keyvault-webhook:1.8.4\""}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n  --repo "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"SparebankenVest/azure-key-vault-to-kubernetes\""}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n  --signer-workflow "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"SparebankenVest/azure-key-vault-to-kubernetes/.github/workflows/webhook-release.yaml\""}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n  --source-ref "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"refs/tags/webhook-1.8.4\""}]}]},{"type":"element","tagName":"span","properties":{"ariaHidden":"true","className":["line-numbers-rows"],"style":"white-space: normal; width: auto; left: 0;"},"children":[{"type":"element","tagName":"span","properties":{},"children":[]},{"type":"element","tagName":"span","properties":{},"children":[]},{"type":"element","tagName":"span","properties":{},"children":[]},{"type":"element","tagName":"span","properties":{},"children":[]},{"type":"element","tagName":"span","properties":{},"children":[]}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Use the matching workflow and tag for each component:"}]},{"type":"text","value":"\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n"},{"type":"element","tagName":"table","properties":{},"children":[{"type":"element","tagName":"thead","properties":{},"children":[{"type":"element","tagName":"tr","properties":{},"children":[{"type":"element","tagName":"th","properties":{},"children":[{"type":"text","value":"Component"}]},{"type":"element","tagName":"th","properties":{},"children":[{"type":"text","value":"Image"}]},{"type":"element","tagName":"th","properties":{},"children":[{"type":"text","value":"Release workflow"}]},{"type":"element","tagName":"th","properties":{},"children":[{"type":"text","value":"Tag format"}]}]}]},{"type":"element","tagName":"tbody","properties":{},"children":[{"type":"element","tagName":"tr","properties":{},"children":[{"type":"element","tagName":"td","properties":{},"children":[{"type":"text","value":"Controller"}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"spvest/azure-keyvault-controller"}]}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"controller-release.yaml"}]}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"controller-<version>"}]}]}]},{"type":"element","tagName":"tr","properties":{},"children":[{"type":"element","tagName":"td","properties":{},"children":[{"type":"text","value":"Webhook"}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"spvest/azure-keyvault-webhook"}]}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"webhook-release.yaml"}]}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"webhook-<version>"}]}]}]},{"type":"element","tagName":"tr","properties":{},"children":[{"type":"element","tagName":"td","properties":{},"children":[{"type":"text","value":"Env executable"}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"spvest/azure-keyvault-env"}]}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"vaultenv-release.yaml"}]}]},{"type":"element","tagName":"td","properties":{},"children":[{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"vaultenv-<version>"}]}]}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Add "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"--format json"}]},{"type":"text","value":" to inspect the verified statement, image digest, and workflow identity."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{"id":"download-attestation-bundles","style":"position:relative;"},"children":[{"type":"element","tagName":"a","properties":{"href":"#download-attestation-bundles","ariaLabel":"download attestation bundles permalink","className":["anchor","before"]},"children":[{"type":"element","tagName":"svg","properties":{"ariaHidden":"true","focusable":"false","height":"16","version":"1.1","viewBox":"0 0 16 16","width":"16"},"children":[{"type":"element","tagName":"path","properties":{"fillRule":"evenodd","d":"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"},"children":[]}]}]},{"type":"text","value":"Download Attestation Bundles"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"For offline verification workflows, download the attestation bundle:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"bash"},"children":[{"type":"element","tagName":"pre","properties":{"style":"counter-reset: linenumber NaN","className":["language-bash","line-numbers"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-bash"]},"children":[{"type":"text","value":"gh attestation download "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n  "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"oci://docker.io/spvest/azure-keyvault-webhook:1.8.4\""}]},{"type":"text","value":" "},{"type":"element","tagName":"span","properties":{"className":["token","punctuation"]},"children":[{"type":"text","value":"\\"}]},{"type":"text","value":"\n  --repo "},{"type":"element","tagName":"span","properties":{"className":["token","string"]},"children":[{"type":"text","value":"\"SparebankenVest/azure-key-vault-to-kubernetes\""}]}]},{"type":"element","tagName":"span","properties":{"ariaHidden":"true","className":["line-numbers-rows"],"style":"white-space: normal; width: auto; left: 0;"},"children":[{"type":"element","tagName":"span","properties":{},"children":[]},{"type":"element","tagName":"span","properties":{},"children":[]},{"type":"element","tagName":"span","properties":{},"children":[]}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{"id":"sbom-assets","style":"position:relative;"},"children":[{"type":"element","tagName":"a","properties":{"href":"#sbom-assets","ariaLabel":"sbom assets permalink","className":["anchor","before"]},"children":[{"type":"element","tagName":"svg","properties":{"ariaHidden":"true","focusable":"false","height":"16","version":"1.1","viewBox":"0 0 16 16","width":"16"},"children":[{"type":"element","tagName":"path","properties":{"fillRule":"evenodd","d":"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z"},"children":[]}]}]},{"type":"text","value":"SBOM Assets"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Component GitHub Releases include SPDX SBOM assets for published platform images. Download the SBOM from the release page for the component tag you deploy, for example "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"webhook-1.8.4"}]},{"type":"text","value":", "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"controller-1.8.4"}]},{"type":"text","value":", or "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"vaultenv-1.8.4"}]},{"type":"text","value":"."}]}],"data":{"quirksMode":false}}},"childMdx":null}},"pageContext":{"id":"8a3da173-679d-503e-ba9f-8e303aab4c13","subtitle":"","versionDifference":0,"versionBasePath":"/v1.8","sidebarContents":[{"title":null,"pages":[{"title":"Overview","sidebarTitle":"","description":"Explore Azure Key Vault to Kubernetes","path":"/"},{"title":"Why use akv2k8s?","sidebarTitle":"","description":null,"path":"/why-akv2k8s/"},{"title":"Quick Start","sidebarTitle":"","description":"Quickly get started using Azure Key Vault to Kubernetes","path":"/quick-start/"},{"title":"How it Works","sidebarTitle":"","description":"Learn about the inner workings of akv2k8s.","path":"/how-it-works/"},{"title":"FAQ","sidebarTitle":"","description":"Most frequently asked questions","path":"/faq/"}]},{"title":"Installation","pages":[{"title":"Overview","sidebarTitle":"","description":"Different options for installing akv2k8s","path":"/installation/"},{"title":"Requirements","sidebarTitle":"","description":"Requirements for installing akv2k8s","path":"/installation/requirements/"},{"title":"Installing on Azure AKS","sidebarTitle":"","description":"How to install Azure Key Vault to Kubernetes (akv2k8s) on Azure AKS","path":"/installation/on-azure-aks/"},{"title":"Installing outside Azure AKS","sidebarTitle":"","description":"Learn how to install Azure Key Vault to Kubernetes outside Azure AKS","path":"/installation/outside-azure-aks/"},{"title":"Updating akv2k8s CRDs","sidebarTitle":"","description":"How to update akv2k8s Custom Resource Definitions (CRDs)","path":"/installation/crd/"},{"title":"Installation without Helm","sidebarTitle":"","description":"How to setup Azure Key Vault to Kubernetes","path":"/installation/without-helm/"},{"title":"Upgrade","sidebarTitle":"","description":"How to upgrade Azure Key Vault to Kubernetes","path":"/installation/upgrade/"},{"title":"Add Exception for aad-pod-identity","sidebarTitle":"","description":"Learn what needs to be done to run successfully with aad-pod-identity","path":"/installation/with-aad-pod-identity/"},{"title":"Installing with Azure Workload Identity","sidebarTitle":"","description":"Learn how to run akv2k8s with Azure Workload Identity","path":"/installation/with-azure-workload-identity/"}]},{"title":"Tutorials","pages":[{"title":"Tutorials","sidebarTitle":"","description":"A quick introduction to the tutorials","path":"/tutorials/"},{"title":"Prerequisites","sidebarTitle":"","description":"A quick overview of the prerequisites needed to complete the tutorials","path":"/tutorials/prerequisites/"},{"title":"Sync Secret","sidebarTitle":"","description":"Sync a secret from Azure Key Vault into a Kubernetes Secret","path":"/tutorials/sync/1-secret/"},{"title":"Sync Certificate","sidebarTitle":"","description":"Sync a certificate from Azure Key Vault into a Kubernetes Secret.","path":"/tutorials/sync/2-certificate/"},{"title":"Sync Signing Key","sidebarTitle":"","description":"Sync signing key from Azure Key Vault into a Kubernetes Secret","path":"/tutorials/sync/3-signing-key/"},{"title":"Sync Multi Key Value Secret","sidebarTitle":"","description":"Sync a multi-key-value secret from Azure Key Vault into a Kubernetes Secret","path":"/tutorials/sync/4-multi-key-value-secret/"},{"title":"Sync Multiple AKVS to One Secret","sidebarTitle":"","description":"Sync multiple AzureKeyVaultSecrets to a single Kubernetes Secret","path":"/tutorials/sync/5-multi-akvs-to-one-secret/"},{"title":"Sync Secret to ConfigMap","sidebarTitle":"","description":"Sync a secret from Azure Key Vault into a Kubernetes ConfigMap","path":"/tutorials/sync/6-secret-to-configmap/"},{"title":"Sync with Namespace Isolation of Controller","sidebarTitle":"","description":"Isolate Akv2k8s Controller to a specific namespace.","path":"/tutorials/sync/7-namespace-isolation-of-controller/"},{"title":"Sync Objects Based on Labels","sidebarTitle":"","description":"How to sync objects based on label selectors","path":"/tutorials/sync/8-label-filtered-syncing/"},{"title":"Sync PFX Certificate Stored as Secret","sidebarTitle":"","description":"Sync a certificate stored as secret from Azure Key Vault into a kubernetes.io/tls Kubernetes secret.","path":"/tutorials/sync/9-certificate-as-AKV-secret/"},{"title":"Inject Secret","sidebarTitle":"","description":"Inject an Azure Key Vault secret directly into a container application","path":"/tutorials/env-injection/1-secret/"},{"title":"Inject Certificate","sidebarTitle":"","description":"Inject an Azure Key Vault certificate key pair directly into a container application","path":"/tutorials/env-injection/2-certificate/"},{"title":"Inject Signing Key","sidebarTitle":"","description":"Inject a signing key from Azure Key Vault as environment variable into an application","path":"/tutorials/env-injection/3-signing-key/"},{"title":"Inject PFX Certificate","sidebarTitle":"","description":"Inject a PFX certificate from Azure Key Vault as environment variables into an application","path":"/tutorials/env-injection/5-pfx-certificate/"}]},{"title":"Security","pages":[{"title":"Authentication with Azure Key Vault","sidebarTitle":"","description":"Learn about the different options for authenticating with Azure Key Vault.","path":"/security/authentication/"},{"title":"Authorization","sidebarTitle":"","description":"Learn how to set the proper access rights in Azure Key Vault","path":"/security/authorization/"},{"title":"Enable Environment Injecton","sidebarTitle":"","description":"Learn how to enable environment injection per Kubernetes namespace","path":"/security/enable-env-injection/"},{"title":"Supply chain verification","sidebarTitle":"","description":"Verify akv2k8s release images, attestations, and SBOMs","path":"/security/supply-chain/"}]},{"title":"Monitoring","pages":[{"title":"Logs","sidebarTitle":"","description":"Akv2k8s logs","path":"/monitoring/logs/"},{"title":"Metrics","sidebarTitle":"","description":"Akv2k8s metrics","path":"/monitoring/metrics/"}]},{"title":"Troubleshooting","pages":[{"title":"Get the akv2k8s Controller Log","sidebarTitle":"","description":"How to access the Controller log and specify log level","path":"/troubleshooting/controller-log/"},{"title":"Set env-injector log-level","sidebarTitle":"","description":"How to set the log-level for the env-injector","path":"/troubleshooting/env-injector-log-level/"},{"title":"Known Issues","sidebarTitle":"","description":"A list of known issues and available solutions or workarounds","path":"/troubleshooting/known-issues/"}]},{"title":"Reference","pages":[{"title":"AzureKeyVaultSecret","sidebarTitle":"","description":"Reference of AzureKeyVaultSecret custom resource definition","path":"/reference/azure-key-vault-secret/"},{"title":"Runtime configuration","sidebarTitle":"","description":"Runtime flags and environment variables supported by akv2k8s components","path":"/reference/runtime-configuration/"}]}],"githubUrl":"https://github.com/sparebankenvest/akv2k8s-website/tree/master/source/content/security/supply-chain.md","spectrumUrl":"","twitterHandle":"","versions":["1.7","1.6","1.5","1.4","1.3","1.2","1.1","1.0"],"defaultVersion":"1.8","baseUrl":"https://akv2k8s.io"}},"staticQueryHashes":["1511030359","2468095761","2468095761","426988268","426988268"]}