Securing container deployments on Azure Kubernetes Service with open-source tools
summary
Claim: pipeline enforces trusted images for AKS by building the Azure Voting App in Rust, scanning and auto-patching images, signing them, and blocking unsigned deploys. The demo uses Trivy (scanner), Copacetic (auto-patcher), Notation (signing) and Ratify with Gatekeeper (admission verification) against Azure Container Registry. Presenter cites 75% of production containers with high/critical vulns and 76% running as root. Demo successfully patches, signs and rejects unsigned images; one DB pod has a transient failure.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 0:38Story
- 2:57Statistics
- 5:15Recap
- 7:21Demo
- 8:50Scan with Trivia
- 11:57Scan with Severity of High
- 12:44Notation
- 14:10Azure Container Registry
- 17:27Update Azure Database Manifest
- 18:32Install Gatekeeper
- 19:13Install ratify
- 20:52Deploy ratify constraint
- 22:20Demonstration of Deploy ratify constraint
- 23:15Deployment logs
- 23:49Logs command
- 24:16Search command
- 24:42GitHub Actions
- 26:06Check Kubernetes manifests
- 27:17Check out the code
- 27:43GitHub action
- 28:32Login to Azure
- 29:52Docker push
- 30:27Notation setup
- 31:12Notation sign
- 32:46Logs
- 34:09Container Registry
- 34:46Create ACR token
- 35:18Questions
- 37:34Trivia
- 38:34Trivia Vulnerability Report
- 39:24Summary
- 39:58GitHub repository
- 40:48Related sessions
related talks
27mNever Break the Chain: Securing the Container Supply Chain with Notary, TUF, and Gatekeeper
48mPentesting Azure Container Services
47mBest-practices for securing your Azure Container Services
52mPentesting Azure Container Services
38mTutorial: Building Security into Kubernetes Deployment Pipelines
59mPentesting Azure Container Services
27mTrue zero-trust runtime security in AKS
05mSecurity In Plain Sight: Hardening Systems Via Open Source