Let Devs Be Devs Without Sacrificing Security
summary
Proof of concept and production builds run through the same pipeline framework while risk is enforced by policy rather than separate processes: Tekton for pipelines, Tekton Chains to emit cryptographic provenance, and Enterprise Contract to gate promotion. Builds exchange data as OCI artifact digests (not PVCs) so provenance maps inputs to outputs and policies verify digests and trusted task origins. A Complex CI reference implementation combines these pieces so one pipeline supports dev, stage, and prod promotions with SLSA-level three guarantees.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 1:03Developer experience at Blue Socks
- 3:52Introducing Salsa and Providence
- 7:09Policy-driven development with Providence
- 10:43Complex tool and its benefits
- 12:53Q&A and future plans
related talks
26mProtect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
19mWho Are You Building For: Pipelines Have a Purpose
10mIt's Time We Start Securing Our CICD Pipelines
33mGrowing the Chain: Trusting Build Provenance from Userspace
16mOperating Tekton with Secure Defaults
34mFrom Code to Deployment: A Deep Dive into Pipelines as Code
29mContinuous Integration and Continuous Delivery Pipelines: Just the Basics
38mSecuring your CI/CD Pipeline