Enforcing a Secure Supply Chain on Kubernetes
Talkat ContainerCon @ Open Source Summit Europe 2022 · on Thursday, 2022-09-15· at 17:05· Wicklow Hall 1 (Level 2), Convention Centre Dublin, Spencer Dock, N Wall Quay, North Wall Dublin 1, D01 T1·
summary
Concrete recipe to block supply‑chain tampering on Kubernetes using Sigstore: use cosign (keyed or cosign keyless) with Fulcio and Rekor (Rekor transparency log), sign images in GitHub Actions, and enforce verification in-cluster with a dynamic admission policy server (WASM policies via kwctl/QWarden). Demo shows a 200‑line Rust verify image signatures policy with ~400 unit tests that rejects unsigned images, accepts GitHub‑signed images, and mutates pods to pin the image digest so deployments are immutable. Policy activation and enforcement work end to end.
AI-written summary · about
chapters (19)
- 0:00Start
- 0:14How To Enforce a Secure Supply Chain in Kubernetes
- 5:09Sign Using a Keeper
- 6:56Verify
- 7:53Root Certificate Authority
- 8:53Transparency Log Record
- 10:44Developers Workflow
- 16:19Github Action
- 18:22Recap
- 19:25Dynamic Admission Control
- 19:39Dynamic Emission Control Works in Kubernetes
- 20:34Schema Validation
- 26:26What Are the Benefits for Us in the Policy World
- 28:20Find Policies
- 32:01Verify Image Signatures Policy
- 32:41Deploy this Policy in the Cluster
- 32:51Cluster Emission Policy
- 35:36Apply the Policy
- 38:45Expanding the Ci Integration
related talks
36mEnforcing a Secure Supply Chain on Kubernetes
15mEnforcing a Secure Supply Chain on Kubernetes
35mEnforcing a Secure Supply Chain on Kubernetes
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
36mKubernetes Supply Chain Security: The Software Factory
34mMake the Secure Kubernetes Supply Chain Work for You
01h 27mSupply Chain Security Tooling
23mSoftware Supply Chain Integrity with Sigstore