A Secure Tekton Task by Using Confidential Containers
summary
Protects a Tekton task and its artifact signing key even if the cluster administrator is compromised by running the task pod inside a trusted execution environment and using sealed secret access gated by remote attestation. A generated rego OPA policy embedded in pod init data validates the pod spec and rejects mutated task pods (mutating webhooks) before unsealing keys. Implemented on OpenShift Pipelines with OpenShift Sandbox Containers and IBM secure execution on IBM Linux One using the pod architecture; overheads include a dedicated VM per TEE and extra image pulls.
AI-written summary · about
chapters (8)
- 0:00Securing Tekton tasks
- 1:51Confidential containers
- 4:27Tekton with confidential containers
- 6:00OpenShift setup
- 7:51Vanilla vs secure pipelines
- 13:44Generating execution policies
- 15:35Summary of benefits
- 16:18Q&A on overhead
related talks
16mOperating Tekton with Secure Defaults
38mConfidential Containers Explained
29mConfidential Containers: The Next Era of Cloud Data Security
14mOperating Tekton Efficiently and Securely for multi-team use cases
30mTekton Chains in Action
22mCloud Native Supply Chain Security with Tekton and Sigstore
15mEnforcing a Secure Supply Chain on Kubernetes
14m"Peer Pods": a confidential computing approach