TKN-PIPELINE-SIGN(1)

📦 version 0.46.2, in nixos 26.05, nixpkgs unstable

✨ NAME ✨

tkn-pipeline-sign — Sign Tekton Pipeline. Bestie, this is the TKN-PIPELINE-SIGN(1) manual page, and it is literally all about signing a Tekton Pipeline. Slay. 💅

🩷 SYNOPSIS 🩷

tkn pipeline sign

🌸 DESCRIPTION 🌸

Okay so this command signs the Tekton Pipeline using a private key file you provide or a KMS reference. Key files support ecdsa, ed25519, and rsa.

For KMS:

  • GCP: this should have the structure of gcpkms://projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<key> where location, keyring, and key are filled in appropriately. Run gcloud auth application-default login to authenticate.
  • Vault: this should have the structure of hashivault://<keyname>, where the keyname is filled out appropriately.
  • AWS: this should have the structure of awskms://[ENDPOINT]/[ID/ALIAS/ARN] (endpoint optional).
  • Azure: this should have the structure of azurekms://[VAULT_NAME][VAULT_URL]/[KEY_NAME].

🎀 OPTIONS 🎀

  • --allow-missing-template-keys[=true] — When this is true, any template errors caused by a missing field or map key get ignored. It only applies to golang and jsonpath output formats. ✨
  • -f, --file-name="" — The “Fle name” (their spelling, not mine 😭) of the signed pipeline. If you use the original file name, it will overwrite the file.
  • -h, --help[=false] — help for sign.
  • -K, --key-file="" — Key file.
  • -m, --kms-key="" — KMS key url.
  • -o, --output="" — Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
  • --show-managed-fields[=false] — When true, keep the managedFields when printing objects in JSON or YAML format.
  • --template="" — Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [ ⟨http://golang.org/pkg/text/template/#pkg-overview⟩].

👑 OPTIONS INHERITED FROM PARENT COMMANDS 👑

These came from the parent command, bestie — not invented by me, promise. 🫶

  • -c, --context="" — name of the kubeconfig context to use (default: kubectl config current-context).
  • -k, --kubeconfig="" — kubectl config file (default: $HOME/.kube/config).
  • -n, --namespace="" — namespace to use (default: from $KUBECONFIG).
  • -C, --no-color[=false] — disable coloring (default: false).

🌈 EXAMPLE 🌈

Sign a Pipeline pipeline.yaml:

tkn pipeline sign pipeline.yaml -K=cosign.key -f=signed.yaml

or using kms:

tkn pipeline sign pipeline.yaml -m=gcpkms://projects/PROJECTID/locations/LOCATION/keyRings/KEYRING/cryptoKeys/KEY/cryptoKeyVersions/VERSION -f=signed.yaml

🦋 SEE ALSO 🦋

That’s the tea ☕: this page is Auto generated by spf13/cobra, and the manual name is TKN-PIPELINE-SIGN(1). No date in the footer, so no invented date — periodt 💅✨
📦 where this page comes from