Kubernetes Supply Chain Security: The Software Factory
Talkat KubeCon + CloudNativeCon North America 2021 · on Wednesday, 2021-10-13· at 11:00· Concourse Hall 151 + Online·
summary
Claims that a Kubernetes Software Factory can greatly reduce supply chain risk while not eliminating it, and that signing is easy, verification is hard. Shows a concrete Tekton-based pipeline with Tekton Chains producing attestations pushed to a transparency log via sigstore / Cosign / Rekor. Demonstrates real attacks: a malicious NPM preinstall creating a reverse shell via NPM preinstall that uses ngrok, hostPID and privileged containers to remount the host fs and fully compromise node, proving build-server and runtime controls are both required.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:28About Control Plane
- 1:34Agenda
- 2:15Supply Chain Security
- 2:46What is a Supply Chain
- 3:37Software Supply Chain
- 3:56Post Bare Metal
- 4:52Software Factory
- 5:43Supply Chain
- 7:32Attack
- 8:21Danger Zone
- 10:36Supply chain compromises
- 13:20How do we attack
- 16:02Salsa
- 19:53Reverse Shell
- 26:19Trivia Scan
- 27:34Signing
- 28:23Container Images
- 29:10Chain Guards
- 31:38Reference Architecture
- 33:58Entoto
related talks
34mMake the Secure Kubernetes Supply Chain Work for You
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
40mEnforcing a Secure Supply Chain on Kubernetes
15mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
22mCloud Native Supply Chain Security with Tekton and Sigstore
34mProtect your software supply chain with Tekton and Sigstore