Bee-Lieve in the Metadata: Pollenating Build Attestations on Kubernetes with...
summary
Build metadata becomes cryptographically verifiable attestations by capturing real runtime events with Tetragon + eBPF, condensing them in a Kubernetes controller called teston and storing signed predicates alongside image digests in Aravista. The demo shows a supply‑chain injection (a “solar sploit” pausing go build and opening main.go repeatedly), a Gatekeeper/Rego policy rejecting the pod, and remediation that produces a clean attestation. Works today with Tetragon v4 and witness for verification.
AI-written summary · about
chapters (9)
- 0:00Build attestations with Kubernetes
- 1:45Secure software supply chain risks
- 4:13Build attestations and metadata
- 7:01Attestations need runtime data
- 8:24Tetron and eBPF for runtime security
- 10:11Tetron blocking malicious builds
- 14:30Policies for build integrity
- 17:30Remediating policy violations
- 20:23Q&A
related talks
28mSee It to Believe It: Bringing Observability to Otherwise ...
27mVerifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon
38mThe Telemetry of Trust, Using Attestations to Secure Your SDLC...
28mIn-toto Attestations for What Really Happens in Your Build Pipelin...
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
20mTrust but Verify
30mTekton Chains in Action
31meBPF-Driven Security for Kubernetes: The Tetragon Story