{"id":18436077,"url":"https://github.com/codenotary/keel-validator","last_synced_at":"2025-08-26T03:03:24.289Z","repository":{"id":109942983,"uuid":"537490994","full_name":"codenotary/keel-validator","owner":"codenotary","description":"Use vcn to validate keep updates on kubernetes","archived":false,"fork":false,"pushed_at":"2023-10-02T10:16:42.000Z","size":24,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-07-04T00:16:18.206Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/codenotary.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-09-16T14:23:21.000Z","updated_at":"2022-09-16T14:27:22.000Z","dependencies_parsed_at":"2024-03-30T23:31:19.422Z","dependency_job_id":null,"html_url":"https://github.com/codenotary/keel-validator","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/codenotary/keel-validator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenotary%2Fkeel-validator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenotary%2Fkeel-validator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenotary%2Fkeel-validator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenotary%2Fkeel-validator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/codenotary","download_url":"https://codeload.github.com/codenotary/keel-validator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/codenotary%2Fkeel-validator/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265560940,"owners_count":23788279,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-06T06:10:14.678Z","updated_at":"2025-07-27T10:34:41.926Z","avatar_url":"https://github.com/codenotary.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Keel validator\n\n## keel.sh\n[Keel](https://keel.sh) is a very simple Kubernetes Operator to automate Helm, DaemonSet, StatefulSet \u0026 Deployment updates.\nIt will track your installations and, when an update is published on their repository, it will update the images.\n\nOne interesting feature of keel is that it can wait for an external approval. When an update is ready to be deployed, a new\napproval request is created. A human supervisor, or a different software, have to vouch the update in order to be performed.\n\nIf you have enabled the web panel, you can check for update approvals using a browser or you can use the rest interface to interact with them. We are going to exploit that for image authentication.\n\n## Image authentication\n\nKeel approval phase is the perfect moment to plug in image authentication. Image is approved only if it is trusted to run.\n\nThis simple deployment is polling keel to see if there are pending approvals. If there are, it tries to authenticate\nusing `vcn` tool from CodeNotary.\n\nIf the image authenticates, that means it was notarized and signed as trusted, so the update is approved.\n\n## Installation\n\nFill in the values for credentials in `keel-validator.yaml` file:\n```yaml\n---\napiVersion: v1\nkind: Secret\nmetadata:\n  name: keel-validator-secrets\ntype: Opaque \ndata: \n  tc-api-key: \u003cTrustCenter_api_key_here\u003e\n  tc-signer-id: \u003ctrusted_signer_id\u003e\n  keel-username: \u003ckeel_web_panel_username\u003e\n  keel-password: \u003ckeel_web_panel_password\u003e\n  registry-json-key: |\n    if_your_registry_needs_json_authentication\n    (like_gcr)_enter_here_your_json_key\n```\n\nthen `kubectl deploy -n keel -f keel-validator.yaml`.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcodenotary%2Fkeel-validator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcodenotary%2Fkeel-validator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcodenotary%2Fkeel-validator/lists"}