Fast & Secure: Package, Sign, Verify, and Deploy
summary
Demonstrates packaging a Helm chart, pushing it to an in-cluster Zot registry, signing it with Cosign (keyless via GitHub and with digest hashes), and having Flux verify the signature before deploying the release, all working end to end after enabling experimental OCI 1.1 support. Uses Helm OCI packages (Helm 3.8+), flux reconcile to force deployment, falls back to legacy signature format for compatibility, and shows copying artifacts with oras for air‑gapped redistribution.
AI-written summary · about
chapters (10)
- 0:00Welcome and introduction
- 2:31GitOps principles explained
- 7:10OCI artifacts and security
- 13:28Demo setup overview
- 18:24Deploying OCI registry Zot
- 19:51Signing Helm chart with Cosign
- 22:45Deploying signed Helm chart via Flux
- 26:29OCI artifacts for air-gap deployments
- 27:52Copying artifacts with ORAS
- 29:17Q&A and closing remarks
related talks
12mLightning Talk: Helm and the Sigstore Ecosystem
20mSecure Delivery Using Flux and Open Component Model
27mHigh-Security, Zero-Connectivity & Air-Gapped Clouds: Delivering Complex Software with the Open Component Model & Flux
50mMastering Modern Software Distribution: On-Prem, Air-Gapped, and BYOC Challenges
35mEnforcing a Secure Supply Chain on Kubernetes
23mSecuring Kubernetes Manifests with Sigstore Cosign, What Are Your Options?
31mSigned, Sealed, Delivered - Sign and Verify All the Things
15mEnforcing a Secure Supply Chain on Kubernetes