tekton-chains

What is tekton-chains?

The tekton-chains image runs the Chains controller, a Kubernetes CRD controller that adds supply chain security capabilities on top of Tekton Pipelines. It operates passively: once deployed, it watches all TaskRun and PipelineRun executions in the cluster. When a run completes, Chains automatically captures a snapshot of the results, converts it into a standardised attestation format (SLSA provenance or in-toto), signs it using a configured cryptographic key, and stores the signature and attestation in a backend of your choice — an OCI registry, Rekor transparency log, or a Kubernetes secret.

This means that every image built through a Tekton pipeline gets a cryptographically signed record of how, when, and from what source it was produced — without any changes to the pipeline definitions themselves. Chains supports x509 keys, cosign key pairs, and KMS-backed keys (AWS KMS, GCP KMS, HashiCorp Vault), and integrates with the Sigstore ecosystem including Fulcio for keyless signing and Rekor for tamper-evident logging.

It is used by platform and DevSecOps teams that need to meet SLSA Level 2 or Level 3 requirements, pass software supply chain audits, or enforce provenance verification as a condition of deployment.

How to use this image

Tekton Chains is deployed as a Kubernetes controller alongside Tekton Pipelines. It requires Tekton Pipelines to already be installed in the cluster, and a signing key provisioned as a Kubernetes secret in the tekton-chains namespace.

Install Tekton Pipelines and Tekton Chains:

kubectl apply --filename \
  https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml
kubectl apply --filename \
  https://storage.googleapis.com/tekton-releases/chains/latest/release.yaml

To use echo's image, patch the controller deployment after installation:

kubectl set image deployment/tekton-chains-controller \
  tekton-chains-controller=registry.echo.ai/tekton-chains:latest \
  -n tekton-chains

Generate a cosign key pair and store it as the signing secret:

cosign generate-key-pair k8s://tekton-chains/signing-secrets

Configure Chains via its ConfigMap to set attestation format and storage backend:

apiVersion: v1
kind: ConfigMap
metadata:
  name: chains-config
  namespace: tekton-chains
data:
  artifacts.taskrun.format: slsa/v1
  artifacts.taskrun.storage: oci
  artifacts.oci.storage: oci
  transparency.enabled: "true"
  transparency.url: https://rekor.sigstore.dev

Once configured, every completed TaskRun or PipelineRun in the cluster is automatically signed. No changes to existing pipeline definitions are required — Chains observes runs cluster-wide and handles attestation transparently in the background.

Image variants

Published under ghcr.io/tektoncd/github.com/tektoncd/chains/cmd/controller and mirrored at registry.echo.ai/tekton-chains, the image ships as a single controller binary:

• tekton-chains:latest — Tracks the most recent stable release. Acceptable for teams that want to stay current with Chains improvements and do not pin pipeline infrastructure images.
• tekton-chains:<version> — Version-pinned tags (e.g., v0.22.0) aligned with Tekton Chains releases. Recommended for production clusters where controlled upgrades and auditability of the signing infrastructure itself matter. The Chains version should be compatible with the installed version of Tekton Pipelines — consult the Chains compatibility matrix before upgrading either component independently.