Know Your Hard:Automate image security scan with Kyverno & Trivy
summary
Demo shows automated image policy enforcement using Kyverno to run as a dynamic admission controller, combined with Trivy for vulnerability scans and cosign for signing and attestation. Two Docker Hub images (signed and unsigned) are scanned, a keypair is generated, the signed image is attested, and a Kyverno policy (checks signature age ~1 hour) denies pod creation for the unsigned image and allows it for the signed image, proving the pipeline works end to end.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 4:37Parenting infrastructure
- 8:31Image security scanning
- 10:42What is Kyverno and how it works
- 13:36Scanning signed images
- 20:01Demo Kyverno setup
- 23:22Demo enforcing policies
- 26:18Q&A
related talks
29mKyverno Chronicles: A DevSecOps Tale
27mPolicy-Based Infrastructure as Code with Kyverno
33mUnlocking the Future of Kubernetes Policy as Code With Kyverno
37mKyverno Introduction And Overview
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
49mKubernetes Policy as Code with Kyverno
27mUnderstanding Kyverno in a Visual Way
35mShift-Left Policy Validation in Kubernetes With Kyvern...