Blocking Vulnerable Workloads Out (And Catching What Got I...
summary
Shows a working integration that combines Kubewarden + SBOM scanner to block images at admission based on registry scans and vulnerability reports. Policies compile to OCI Wasm policy module artifacts built from Go Rust or TypeScript SDKs. The SBOM scanner currently uses Trivy to produce VulnerabilityReport CRDs for scanned registries. An image CV policy enforces per‑severity maxima (example configuration: zero critical vulnerabilities) and denies deployments that exceed those counts.
AI-written summary · about
related talks
34mContainer Vulnerability Management in Kubernetes
15mPolicy control for Software Supply Chain
46mSafely through the dependency minefield using OWASP Dependency Track
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
31mAutomatic application hardening by leveraging container runtime behavior analysis
29mCompliance in Kubernetes: Enforcing and Visualizing
43mA radiography of a SBOM vulnerability scanner
48mBuilding GDPR, ISO27001 Containerized Application for continuous compliance