Integrating Security in the Build Pipeline
summary
Cloud native CI/CD pipeline wired to block vulnerable images: source on GitHub, build with Tekton, deploy with Argo CD, store and scan images in Harbor using Trivy (Clair shown as secondary). Pipeline builds an nginx-from-Debian image, Trivy finds high/critical CVEs and the run stops; switching to Ubuntu yields only medium/lower severities and the image is promoted from test to prod and deployed. Scans run against pushed images and fail the build if high/critical vulnerabilities are detected.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:15About me
- 0:50Disclaimer
- 1:13Agenda
- 2:30Why are we here
- 4:24Phase Shifting
- 4:58Trust Relationship
- 8:32CI CD
- 9:44Vulnerability Scanner
- 10:16Demo
- 12:36Hardware Dashboard
- 14:10Help Charts
- 16:28Example App
- 20:48Test Project
- 21:19Security Scan
- 21:52Outro
related talks
34mContainer Vulnerability Management in Kubernetes
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack
37mA Secure Continuous Delivery Pipeline
35mFrom Builds & CI to Security Testing in a Single PR
24mSecuring Container Workloads
18mContinuous Security - Building Security into your Pipelines
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
25mCloud Native Deployments in Air Gapped Environments