Issue Description
flux install --export generates controller manifests that reference Flux controller images by tag, for example:
spec:
containers:
image: ghcr.io/fluxcd/source-controller:v1.8.2These tags are mutable from a supply-chain perspective. Registries such as GHCR do not provide an immutable guarantee for tags alone.
This means the generated manifests are not pinned to a specific image digest, so a first pull or a pull on a new node may retrieve different content than what the operator originally reviewed. Importantly, this poses an unnecessary supply chain risk: A malicious actor could, if gained write access to fluxcd's GHCR artifacts, overwrite released artifacts to contain malware. Flux clusters would download these artifacts and execute them without any further intervention.
Suggested Solution
flux install --export should emit image tags that look like this:
spec:
containers:
image: ghcr.io/fluxcd/source-controller:v1.8.2@sha256:f2f6fd483b9a8b8c69f8ebe9f2277be23093a2b552b3578a6db15710d736bb0eThis way, immutability is guaranteed from a cluster operator's perspective. Since flux should be secure by default, I suggest this behaviour to become the new default. If, for whatever reason, the old behaviour is still needed in some scenarios, one could think about introducing a flag --no-pin-digest, but I don't see a reason why it should make sense.
Issue Description
flux install --exportgenerates controller manifests that reference Flux controller images by tag, for example:These tags are mutable from a supply-chain perspective. Registries such as GHCR do not provide an immutable guarantee for tags alone.
This means the generated manifests are not pinned to a specific image digest, so a first pull or a pull on a new node may retrieve different content than what the operator originally reviewed. Importantly, this poses an unnecessary supply chain risk: A malicious actor could, if gained write access to fluxcd's GHCR artifacts, overwrite released artifacts to contain malware. Flux clusters would download these artifacts and execute them without any further intervention.
Suggested Solution
flux install --exportshould emit image tags that look like this:This way, immutability is guaranteed from a cluster operator's perspective. Since flux should be secure by default, I suggest this behaviour to become the new default. If, for whatever reason, the old behaviour is still needed in some scenarios, one could think about introducing a flag
--no-pin-digest, but I don't see a reason why it should make sense.