We Built the Kubernetes SBOM and Now You Can Write Your Own!
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 11:00· Room 408 AB + Online·
summary
Kubernetes Release Engineering produces an SPDX-based SBOM that lists ~24,000 source files, 25 multi-arch images and 53 standalone binaries, and provides libraries plus a CLI to reproduce it. The tool offers bom generate to scan directories, container registries and Go modules (it computes transient deps from go.mod), emits a SPDX-compliant SBOM in tag-value form, and can create experimental provenance attestations; RPM/package analysis, extra output formats and verification are ongoing.
AI-written summary · about
chapters (24)
- 0:00Intro
- 2:17Kubernetes Container Images
- 2:39Kubernetes Release Overview
- 4:14Our Mission
- 5:18SBOM Definition
- 6:36Kubernetes Release
- 7:29Building the SBOM
- 8:39Linear Response
- 9:38Linux Foundation
- 10:02SPDX
- 10:23Building a better Kubernetes system
- 12:42Creating a bill of materials
- 14:07Declarative SBOM definition
- 14:39Demo
- 15:08Test Project
- 15:42Output Director
- 16:17Overview
- 17:07Licensing
- 17:48Git Ignore
- 20:25Visualization
- 23:37Structure
- 27:11Provenance
- 28:28attestation
- 29:50future plans
related talks
28mLeverage Kubernetes SPDX Tools to Create Your SBOM
38mThe State of SBOMs
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
35mFrom Kubernetes With ♥ Open Tools For Open, Secure Supply Chains
36mSBOMs, VEX, and Kubernetes
43mUsing SBOMs for Linux Foundation Projects
35mTransforming SBOMs from Compliance Burden to Security Asset
34mMake the Secure Kubernetes Supply Chain Work for You