Enforcing a Secure Supply Chain on Kubernetes
summary
Shows a working pipeline that signs container images and Wasm policies with cosign and records certificates in Fulcio and Rekor, storing signatures in the OCI registry and transparency log. Demonstrates keyless signing via OIDC tokens from GitHub Actions so CI signs artifacts without managing private keys. Deploys a Kyverno policy that rejects unsigned images, mutates accepted pods to pin image digests, and rejects an unsigned nginx pod while accepting a signed one, proving the enforcement loop actually blocks tampered images.
AI-written summary · about
chapters (12)
- 0:00Introduction to secure supply chain
- 3:13Threat model and SALSA framework
- 7:30Sigstore tools overview
- 11:24Keyless signing with Sigstore
- 16:33Signing artifacts in CI/CD
- 17:16Dynamic admission control in Kubernetes
- 20:04Kyverno policy engine setup
- 23:41Signing and verifying Kyverno policies
- 26:45Enforcing signed container images
- 31:20Testing policy enforcement
- 32:43Securing dependencies with SBOM
- 33:26Future of supply chain security
related talks
15mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
40mEnforcing a Secure Supply Chain on Kubernetes
22mSecuring Kubernetes Manifests with Sigstore and Kyverno
42mDid you sign this (image)?
34mMake the Secure Kubernetes Supply Chain Work for You
36mKubernetes Supply Chain Security: The Software Factory
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge