Hardening the Kubernetes Software Supp...
summary
Kubernetes release tooling now produces an SPDX Bill of Materials with v1.22 and emits two BOMs per release (artifacts and source), adds automatic artifact integrity checks and plans digital signing and signature verification of images. The release orchestrator is krel rewritten in Go (removed bash in late 2020), enabling parallel builds, retries, secret filtering, testable mocks, and ownership of the container-image-promoter; work aims for Salsa level 1 provenance attestation and further compliance.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 6:44Past Years: Foundations a New Release Process
- 9:15Ownership of the Container Image Promoter
- 11:38Current Efforts for 2021 and Beyond
- 18:29SLSA Compliance
- 20:02People+Code (We need to talk)
- 22:55Closing Remarks
related talks
28mLeverage Kubernetes SPDX Tools to Create Your SBOM
34mMake the Secure Kubernetes Supply Chain Work for You
38mHow SIG Release Cooks Trustworthy Artifacts From Raw Source Code
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
26mAn OSS project's attempt to secure it's supply chain
05mSupple Supply Chain Security With kpack!
37mSupply Chain Security in Kubernetes
38mThe State of SBOMs