Sigstore Or: How We Learned to Stop Trusting Registries and Love Sig...
summary
InfluxData adds image signing across its multi-cloud SaaS that runs over 50 microservices and ~100 container images, building an internal image-signing service that calls cosign logic, stores signatures in registries (internal and an external signatures registry for third-party images), and enforces verification with policy-controller in every cluster. Vault holds signing keys via transit, automated gitops rotates keys on a schedule, CI has no private keys, and Argo CD handles emergency rollout — deployment is working and SRE runbooks make key rotation and rollback trivial.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:54Rationale and goals
- 6:26InfluxDB Cloud and container images
- 13:41Automation and scaling out
- 17:24Handling Security Incidents
related talks
40mSigstore: How We Started, Where We Are, Where We are Headed
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
23mSoftware Supply Chain Integrity with Sigstore
36mSigstore: Past, Present and Future Directions
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
42mDid you sign this (image)?
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
36mEnforcing a Secure Supply Chain on Kubernetes