No Unsigned Models in My Cluster: Bringing Container Trust to AI Models on K8s
summary
Practical pipeline that signs model directories with OMS v1.0 (keyless cosign-style flow, Rekor transparency logging), injects a verification init container via the Sigstore Model Validation Operator at pod admission, and enforces label requirements with Kyverno to block unsigned models. Live demo signs, deploys, then overwrites weights and shows verification fail and pod blocked. Operator is alpha, works today for byte-for-byte artifacts but breaks for quantized or adapter-merged models, has hashing/format instability, and needs AIBOM/provenance integration.
AI-written summary · about
chapters (14)
- 0:00Container trust for AI models
- 1:03Risks of unverified model artifacts
- 3:11Why no cryptographic verification
- 4:13Model signing with OMS and Sigstore
- 6:25Verifying with Rekor logs
- 7:51Enforcing with Sigstore operator
- 9:37Closing gaps with Kyverno
- 13:14Demo: signing and deploying trusted model
- 18:30Blocking supply chain attack
- 21:21Practical challenges in signing
- 23:07Beyond signing with AI SBOM
- 23:48Regulatory implications
- 24:52Future roadmap
- 26:15Call to action
related talks
35mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
34mPoison Control: Unifying Software and Content...
22mSecuring Kubernetes Manifests with Sigstore and Kyverno
26mTaming ML’s Wild West: Practical Model Signing with Sigstore on Kaggle
42mDid you sign this (image)?
26mWho's Verifying Your Signatures? Approaching Private Container Image Signing
15mEnforcing a Secure Supply Chain on Kubernetes