Securing Kubernetes Manifests with Sigstore and Kyverno
summary
Shows an end-to-end system that signs Kubernetes YAMLs with cosign CLI and embeds an annotation-embedded signature so a cluster-side Kyverno validating admission controller verifies authenticity and integrity at admission time. Signing injects an encoded message and signature into annotations, CI or GitHub Actions produce signatures, and Kyverno either denies unsigned changes or computes a dry-run/diff to tolerate legitimate mutating controllers. Demo deploys signed Deployment, blocks unsigned edits, and explains ignore lists and dry-run tradeoffs.
AI-written summary · about
chapters (4)
- 0:00Start
- 5:37Signing a YAML manifest
- 6:27Verify signature of YAML manifest
- 10:13Solution 2: dry-run & diff
related talks
23mSecuring Kubernetes Manifests with Sigstore Cosign, What Are Your Options?
35mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
26mSecuring GitOps Supply Chain with Sigstore and Kyverno
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
15mEnforcing a Secure Supply Chain on Kubernetes
40mEnforcing a Secure Supply Chain on Kubernetes
39mKicking Security Chain Attacks to the Curb with Kyverno and Notary...