Trust But Verify: Bringing Supply Chain Integrity To CD GitOps
Talkat KubeCon + CloudNativeCon North America 2022 · on Thursday, 2022-10-27· at 16:30· Ambassador Ballroom (Room 360)·
summary
Proposes end-to-end signature protection for CD GitOps by verifying source repo signatures, signing generated Kubernetes manifests, and enforcing them at admission time. Uses argocd-interest controller to monitor Argo CD syncs, verifies source artifacts with Sigstore, produces OCI-signed manifest images, and records provenance to a transparency store. Admission enforcement via integrity-shield (OPA Gatekeeper integration) blocks unsigned or tampered changes; demo shows attacker edits to repo or cluster are rejected.
AI-written summary · about
chapters (8)
- 0:00Supply chain integrity in CD GitOps
- 2:18Supply chain risks in pipelines
- 5:32Manifest signing enforcement
- 8:47Templated manifests challenges
- 13:02ArgoCD Interest introduction
- 16:18Live demo: ArgoCD Interest
- 26:48Verify approach benefits
- 27:57Q&A: Interest profiles
related talks
36mEnforcing a Secure Supply Chain on Kubernetes
34mSecure by Default with GitOps - A Guide to OPA with Argo CD
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
15mEnforcing a Secure Supply Chain on Kubernetes
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
40mEnforcing a Secure Supply Chain on Kubernetes
06mLightning Talk: Secure GitOps for Regulated Workloads: Argo CD Meets Confidential...