Flux at the Point of Change - Using the K8s Golang SDK and the Flux Api to Automatically Fix and Deploy CVEs in Your Base Images
summary
Claims an end-to-end system that automatically remediates CVEs by updating Dockerfiles and enforcing versions at cluster admission using Kubernetes Client-Go and the Flux API. Builds an image-updater bot (TypeScript production version, Go demo) that calls Flux ImagePolicy to bump base images in repos, and a Gatekeeper/OPA admission controller that blocks deployments whose image version is below policy. Demo shows a Dockerfile auto-updated and a bad-version deployment rejected on-cluster, and the approach is proven in multiple enterprises.
AI-written summary · about
chapters (10)
- 0:00Flux and CVEs introduction
- 1:03CVE scanning and image updates
- 2:29Auto-updating Dockerfile base images
- 4:37Compliance in Kubernetes changes
- 6:22Demo: Rust base image updates
- 10:41Security policies with OPA Gatekeeper
- 12:07Gatekeeper image validation
- 16:22Demo: Deployment blocking
- 17:51Workflow recap
- 19:37Q&A on new vulnerabilities
related talks
33mFlux Ecosystem Evolution
37mDevelopers Love GitOps
38mFlux Security Deep Dive
39mEnhance Your Kubernetes Experience with GitOps & Flux
21mIntroduction to FluxCD
33mMay the Flux Be With You: Tales From the GitOps Trenches
38mAutomated & Observable Deployments with Flux + Keptn
08mFlux-Powered Bootstrapping a Kubernetes With GitOps and CaC