Flux CD
Hard
Security
Which GitRepository setting makes Flux check that the tag it checks out was signed with a trusted PGP key?
Select your answer:
Show answer and explanation
Answer: spec.verify.mode: Tag, with a secretRef to the public keys
Explanation
verify.mode chooses what to check: HEAD checks the commit that was checked out, Tag checks the tag object, and TagAndHEAD checks the tag and the commit it points to. The Secret holds the trusted public keys. If verification fails, no new revision reaches the cluster.
More hard Flux CD questions
- One kustomize-controller can't keep up with thousands of Kustomizations. How does Flux split the work?
- What does 'flux reconcile kustomization my-app' change on the object to trigger a reconciliation?
- A ConfigMap applied by a Flux Kustomization holds a shell script using ${HOME}, and postBuild substitution blanks it out. What stops that?
- A HelmRelease in flux-system sets targetNamespace: apps and no storageNamespace. Where does Helm keep the release's storage Secrets?
- How can an OCIRepository authenticate to Amazon ECR without a static registry password?
- You need to add a label to a Deployment that a third-party chart renders, and the chart has no value for it. What does a HelmRelease offer?