portieris

Portieris

Chainguard's redistribution of the Portieris Helm chart, pre-configured with hardened Chainguard Images.

Portieris is a Kubernetes admission controller from IBM that verifies image trust. It enforces ImagePolicy and ClusterImagePolicy resources so that only images matching your signing and provenance requirements are admitted to the cluster.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace portieris

Installation

helm install portieris oci://cgr.dev/ORGANIZATION/charts/portieris \
  --namespace portieris \
  --create-namespace \
  --set image.pullSecret=cgr-pull-secret

The chart installs the ImagePolicy and ClusterImagePolicy custom resource definitions along with the admission webhook. Review the default clusterPolicy.allowedRepositories value before use: it is permissive and admits all images in namespaces that have no ImagePolicy.

About This Chart

This is a redistribution of the upstream Portieris Helm chart. All upstream configuration options and documentation apply.

For full documentation, see: https://github.com/IBM/portieris