How SIG Release Cooks Trustworthy Artifacts From Raw Source Code
summary
Three releases per year plus monthly or biweekly patch releases, with v1.25 shipping 40+ enhancements, get built on Google Cloud Build into binaries and container images staged in registry.k8s.io; build runs produce SBOMs and SLSA-style provenance, and images are signed and verifiable with cosign. An image promoter (kpromo) creates a GitHub PR to enumerate promotions, automation copies and re-signs images, but Debian/RPM package signing still requires Google help and some manual PR review so the pipeline is mostly automated but not fully finished.
AI-written summary · about
chapters (14)
- 0:00Welcome to SIG Release
- 1:06Talk agenda and roadmap
- 2:11Kubernetes 1.25 changes
- 2:34Kubernetes 1.26 release
- 3:16Roadmap: consumability and security
- 5:22Source to artifacts process
- 9:09Live demo: cutting a release
- 15:49Trusting and verifying artifacts
- 18:17Verifying signed images
- 20:45Community infrastructure shift
- 22:12Future plans and tooling
- 27:57Securing Kubernetes releases
- 28:18Getting involved with SIG Release
- 31:05Q&A
related talks
34mMake the Secure Kubernetes Supply Chain Work for You
31mHardening the Kubernetes Software Supp...
28mLeverage Kubernetes SPDX Tools to Create Your SBOM
36mWhere Does Your Software (Really) Come from?
49mDeploying to production with confidence
35mPractical Guides for Enhancing Your Software Supply Chain Security
50mMastering Modern Software Distribution: On-Prem, Air-Gapped, and BYOC Challenges
28mBuilding Images for the Secure Supply Chain