TKN-PIPELINE-SIGN(1)

NAME

tkn-pipeline-sign - Sign Tekton Pipeline

SYNOPSIS

tkn pipeline sign

DESCRIPTION

    Sign the Tekton Pipeline with user provided private key file or KMS reference. Key files support ecdsa, ed25519, rsa.
    For KMS:
    * GCP, this should have the structure of gcpkms://projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<key> where location, keyring, and key are filled in appropriately. Run "gcloud auth application-default login" to authenticate
    * Vault, this should have the structure of hashivault://<keyname>, where the keyname is filled out appropriately.
    * AWS, this should have the structure of awskms://[ENDPOINT]/[ID/ALIAS/ARN] (endpoint optional).
    * Azure, this should have the structure of azurekms://[VAULT_NAME][VAULT_URL]/[KEY_NAME].

OPTIONS

--allow-missing-template-keys[=true]
    If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

-f, --file-name=""
    Fle name of the signed pipeline, using the original file name will overwrite the file

-h, --help[=false]
    help for sign

-K, --key-file=""
    Key file

-m, --kms-key=""
    KMS key url

-o, --output=""
    Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).

--show-managed-fields[=false]
    If true, keep the managedFields when printing objects in JSON or YAML format.

--template=""
    Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [ ⟨http://golang.org/pkg/text/template/#pkg-overview⟩].

OPTIONS INHERITED FROM PARENT COMMANDS

-c, --context=""
    name of the kubeconfig context to use (default: kubectl config current-context)

-k, --kubeconfig=""
    kubectl config file (default: $HOME/.kube/config)

-n, --namespace=""
    namespace to use (default: from $KUBECONFIG)

-C, --no-color[=false]
    disable coloring (default: false)

EXAMPLE

Sign a Pipeline pipeline.yaml:
    tkn pipeline sign pipeline.yaml -K=cosign.key -f=signed.yaml or using kms
    tkn pipeline sign pipeline.yaml -m=gcpkms://projects/PROJECTID/locations/LOCATION/keyRings/KEYRING/cryptoKeys/KEY/cryptoKeyVersions/VERSION -f=signed.yaml

SEE ALSO

tkn-pipeline(1)