Running Trusted Payloads With Nomad and Waypoint
summary
Describes a concrete pipeline: Waypoint builds and fingerprints Docker images, runs vulnerability scans (Snyk), stores SBOMs, and promotes artifacts not source. Nomad deploys signed images using Vault-issued short-lived credentials and Docker Content Trust; Harbor holds signed registry artifacts and revocation is supported. Demonstrates pre-deploy image-inspect and Nomad pre-tasks to validate fingerprints, showing how automated signing, fingerprint checks, and secret rotation prevent accidental or malicious payloads from reaching production.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:48Background
- 2:02The Problem
- 5:13Confidence in Production
- 6:01Adding Tests
- 7:07Sharing Pain
- 8:11Waypoint
- 10:36Dont Trust The Internet
- 12:39Know thyself
- 15:48Nomad
- 16:23Nomad jobs
- 18:04Vault
- 19:50Docker Registry
- 20:41Generating a key
- 22:18Validate
- 23:13Summary
related talks
39mBuilding Efficient Continuous Integration Pipelines with Nomad, Vault and Jenkins
35mThe State of Your Supply Chain
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
38mTutorial: Building Security into Kubernetes Deployment Pipelines
26mA Nomadic Vault: Secrets for Schedulers and Runtimes
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
27mNever Break the Chain: Securing the Container Supply Chain with Notary, TUF, and Gatekeeper
34mSecuring your Kubernetes Delivery Pipelines with Notary and TUF