See It to Believe It: Bringing Observability to Otherwise ...
summary
Claims a practical pipeline to record low-level build behavior so CI-produced images carry verifiable evidence that they ran without unexpected network or file activity. It uses tetragon (eBPF) to capture syscalls, process execs, file accesses and TCP connects, and uses Tekton Chains to package a signed in-toto-style runtime attestation attached to the TaskRun. Example shows detection of a TCP send (so not a hermetic build). Proposal adds a compact predicate and plans GUAC integration for policy checks.
AI-written summary · about
chapters (10)
- 0:00Runtime attestations intro
- 1:26Supply chain security challenges
- 3:33Process security importance
- 6:45Runtime monitoring design
- 9:58Tetragon for runtime tracing
- 12:34Tekton Chains + Tetragon
- 15:01Live runtime attestation demo
- 21:01Attestation data management
- 23:27Future roadmap & community
- 25:11Q&A
related talks
28mIn-toto Attestations for What Really Happens in Your Build Pipelin...
10mIt's Time We Start Securing Our CICD Pipelines
18mLet Devs Be Devs Without Sacrificing Security
26mProtect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
30mTekton Chains in Action
23mBee-Lieve in the Metadata: Pollenating Build Attestations on Kubernetes with...
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
36mSecuring CI/CD Systems Through eBPF