Lightning Talk: Securing CI/CD Infrastructure for Tinkerbell
summary
Tinkerbell’s CI/CD runners for bare‑metal provisioning are fully automated and secured using Pulumi Cloud for stack and secret storage, SaltStack pillars to distribute secrets to minions without SSH, and Teleport via GitHub SSO for audited SSH access. Secrets and tokens stay encrypted in Pulumi, Salt minions only talk to the Salt master, Teleport restricts access to private IPv4 and records/joinable sessions, and the system exposes activity views and audit logs so runner provisioning and access are visible and reproducible.
AI-written summary · about
chapters (7)
- 0:00Securing Tinkerbell's CI/CD
- 1:06Bare metal provisioning challenges
- 2:07Pulumi for secure automation
- 3:33Salt Stack for provisioning
- 5:21Access with Teleport and GitHub SSO
- 6:50Live demo of stack
- 9:44Closing and key takeaways
related talks
14mLightning Talk: 5 Security Tips for Terraform
39mControlled Mayhem With Cloud Native Security Pipelines
13mLightning Talk: The Successful Recipe to Secure Your Fleet of...
38mSecuring your CI/CD Pipeline
32mGotchas Using Terraform in a Secure Delivery Pipeline
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
06mLightning Talk: Secure GitOps for Regulated Workloads: Argo CD Meets Confidential...
43mThe art of secure software: Zero-trust delivery pipelines