Weaving a VEX Feed Through the Kubernetes Project
summary
Kubernetes now publishes a machine-readable VEX feed that ties CVEs to specific branches, modules and container images using OpenVEX, created from three sources: automated Go vulncheck reachability results plus maintainer assessments, advisory data emitted as OSV, and future base‑image scans. A new tool, VEX flow, opens triage issues, captures owner approvals from OWNERS files, assembles OpenVEX documents, signs them with Sigstore and attaches attestations to images. The flow blocks releases via policy checks in tests and is working in initial runs across the project’s 3–4 maintained branches.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:04VEX overview today
- 3:51VEX status messages
- 6:00VEX in Kubernetes
- 8:26Kubernetes VEX feed design
- 13:03Go VULN check implementation
- 16:56VEX flow tool demo
- 22:13Status and future plans
- 23:20Q&A
related talks
26mWeaving a VEX Feed Through the Kubernetes Project
45mVEXing Open Source Security: Vulnerability Data for Everything
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
12mKeynote: We’re VEXing the Cloud Native Landscape. Bring Your Code!
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
48m5 Steps to VEX Success: Managing the End-to-End Workflow
19mFinally! Automated End-to-End VEX Streams You Can Trust
50mDemocratizing Exploitability Data with OpenVEX