Skip to content

ADR-0005: Tekton + Chains for the in-boundary attestation chain

Status: Accepted — 001-walking-skeleton (2026-06) Principles served: III, I Source: docs/design.md D4; specs/001-walking-skeleton/research.md D-5; pipelines/tekton/chains-config.yaml

Context

Every artifact must carry a verifiable attestation chain from prompt to production — prompt hash, model identity and version, produced artifact versions, and test results — and nothing about a build may leave the customer boundary. The build system therefore has to emit signed SLSA provenance natively, in-cluster, without depending on public signing infrastructure.

Decision

Tekton Pipelines builds the app image; Tekton Chains observes every PipelineRun and emits an in-toto/SLSA provenance attestation (slsa/v2alpha3), cosign-signed, stored as an OCI artifact in Harbor co-located with the image. Tekton was chosen over Argo Workflows specifically for Chains' native SLSA support. Concrete configuration (pipelines/tekton/chains-config.yaml):

  • Signing uses a cosign x509 key from the in-cluster signing-secrets Secret; signers.x509.fulcio.enabled: "false" — no external Fulcio CA.
  • transparency.enabled: "false" — no external Rekor transparency log; in-boundary only (Principle I).
  • All attestation storage is oci in Harbor; no external attestation store.
  • The pipeline's sign-and-attest task attaches the contract-exact image attestation carrying the Tend custom fields buildDefinition.externalParameters.tend.{appRef, promptHash, model, builder, sourceCommit}, read from the commit trailers the builder adapter records at commit time.

Alternatives considered

  • Argo Workflows — rejected: no native attestation support; design D4 chose Tekton for Chains.
  • GitHub Actions / external CI — rejected: off-boundary.

Consequences

Provenance is emitted, signed, and stored entirely in-boundary, and Kyverno verifies the attestation at admission (ADR-0006), closing the chain. Disabling Rekor and Fulcio trades public transparency-log verifiability for boundary integrity — the correct trade for this product, since the verifier lives in the same cluster and trusts the published cosign public key. A builder commit missing its prompt-hash or model trailers produces an attestation that fails the Kyverno gate downstream, by design.