Trust but Verify
summary
Kubernetes makes reproducible CI easy but still lets humans expose clusters or run corrupted images; the concrete answer shown is a policy engine that ships policies as WebAssembly modules distributed via OCI and enforced by an admission controller. The demo runs on k3d with Jenkins pipelines being rejected for images tagged latest, policies can mutate manifests or verify image signatures with Sigstore, policy authors use familiar languages (Rust/Go) to build Wasm binaries, and enforcement gives fast feedback to CI jobs.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker intro
- 1:04Trust in open source projects
- 2:28Risks in infrastructure and collaboration
- 5:38Policies for trust and security
- 7:44Kubernetes policy engines overview
- 9:48Demo of kubewarden policies
- 17:50Benefits of policy engines
- 18:12Q&A session
related talks
15mEnforcing a Secure Supply Chain on Kubernetes
35mEnforcing a Secure Supply Chain on Kubernetes
40mEnforcing a Secure Supply Chain on Kubernetes
30mEstablishing Image Provenance and Security in Kubernetes - Adrian Mouat, Container Solutions
36mEnforcing a Secure Supply Chain on Kubernetes
31mImage Provenance and Security in Kubernetes
41mKubernetes Policy As Code using WebAssembly
41mLeveraging WebAssembly to Write Kubernetes Admission Policies