Software Supply Chain Management with Grafeas and Kritis
summary
Grafeas provides an artifact metadata API to store build, test and vulnerability records; Kritis enforces deploy-time admission webhook policies for Kubernetes by querying Grafeas and using attestations stored with pluggable backends (Postgres example). Google runs similar systems at scale—over 2 billion containers a week—and the projects are already used in production and exposed in GCP (vulnerability scanning, Binary Authorization). Kritis admits images once with signed attestations to allow scaling, then runs periodic checks to mark running pods noncompliant if new CVEs appear.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:36Agenda
- 2:29Software Supply Chain
- 13:48Kritis Terminology
- 16:53Grafeas
- 17:34Artifacts
- 18:06Terminology
- 19:51Resources
- 21:22Grafeas Development
- 22:43Summary
- 24:09Goals
- 25:01Scope
- 25:36Features
- 26:51Questions
related talks
36mBinary Authorization in Kubernetes
40mFun with Continuous Compliance
28mKnow Your Kubernetes Deploys
36mSecure your software supply chain from dependencies to deployment
09mKeynote: Software Supply Chains for Devops
34mContainer Vulnerability Management in Kubernetes
37mSupply Chain Security in Kubernetes
31mImage Provenance and Security in Kubernetes