Enforcing a Secure Supply Chain on Kubernetes
summary
Shows how to enforce image provenance on Kubernetes by signing images with the Sigstore stack and verifying them in an admission controller that rejects unsigned images and mutates pods to append the image digest so mutable tags cannot be exploited. Uses cosign keyless signing (or KMS-backed keys), Fulcio certificates and the Rekor transparency log, integrates with GitHub Actions OIDC, stores SBoMs in OCI artifacts, runs policy WASM modules via a ClusterAdmissionPolicy CRD, and fails pod creation when verification does not match.
AI-written summary · about
chapters (5)
- 0:00Start
- 5:13Keyless Mode
- 9:11Dynamic Condition Controller
- 14:35Sign and Verify Images
- 20:02Instantiate the Pod with Untrusted Images
related talks
40mEnforcing a Secure Supply Chain on Kubernetes
35mEnforcing a Secure Supply Chain on Kubernetes
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
34mMake the Secure Kubernetes Supply Chain Work for You
23mSecuring Kubernetes Manifests with Sigstore Cosign, What Are Your Options?
42mDid you sign this (image)?
22mSecuring Kubernetes Manifests with Sigstore and Kyverno
23mSoftware Supply Chain Integrity with Sigstore