Adventures in Production with GitOps, Secure Pipelines & Compliance
summary
A Tekton pipeline on Minikube builds a Python Flask app, running python-safety and hadolint, containerizes it, runs a Trivy image scan, then encrypts the image with Scorpio and pushes to a local registry; an entropy check shows 0% compressibility so encryption actually worked. The flow ties in image signing and provenance via in-toto, workload identity via SPIFFE/SPIRE, and recommends GitOps tools (Flux, Skaffold/Jenkins X) and policy gates (OPA/Gatekeeper) to enforce compliance.
AI-written summary · about
chapters (6)
- 0:00Start
- 4:05VULNERABILITIES
- 4:59DEVELOPER TOOLS
- 5:27VULNERABILITY SCANNING
- 7:19IMAGE ENCRYPTION
- 7:54SECRET MANAGEMENT
related talks
27mAdventures in Production with GitOps, Secure Pipelines & Compliance - Brandon Lum & Ricardo Aravena
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
10mIt's Time We Start Securing Our CICD Pipelines
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
37mA Secure Continuous Delivery Pipeline
41mBeyond Guidelines - Designing & Implementing Robust Build Pipelines
22mGitOps - The Magic Key to Cloud Native Security- 32mBuilding a Secure By-Design Pipeline with an Open Source Stack