A tale of 3 goats - Immutable infrastructure security
summary
Scans real repos and reports concrete results: a Helm scanner templates every chart and runs Checkov to flag insecure defaults, producing a dataset of 2,300+ charts across 600 repositories. Demo code exercises vulnerable playgrounds like terra goat and a vulnerable Kubernetes repo, shows CI/CD integration (GitHub Action example) and fails builds on policy violations. The tooling and dataset exist and run end to end, yielding actionable misconfiguration counts and remediation pointers.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:45What is devsecops
- 8:40What is infrastructure security
- 9:30Terraform
- 12:06Vulnerability
- 14:07Application security
- 15:08Kubernetes
- 15:38Kubernetes as IAC
- 17:32ArtifactHub
- 18:09Helm Charts
- 20:25Three blog posts
- 21:05What we found
- 22:41Checkover
related talks
37mAI Goat: A Damn Vulnerable AI Infrastructure
24mWhy security fails, and how we can solve for it
22mGitOps - The Magic Key to Cloud Native Security
32mClimbing high — getting started with cloud native security through open source
39m5 Open Source Security Tools All Developers Should Know About
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
12mEnd-to-end policy-as-code from IaC to Running Workloads