Hardening Spinnaker Pipelines
summary
Spinnaker now enforces runtime pipeline controls by running a Policy Engine plugin inside Orca that packages stage and task context as a 700-line JSON payload and sends it to Open Policy Agent for decisions. The system denies executions (example: blocking manual triggers) and allows webhook-triggered runs, supports unit-tested Rego policies, decision logging, bundles/hot‑patching, and enables planned checks like artifact signature verification and separation‑of‑duty enforcement. Deployed at Snap and in Armory/Styra integrations, it works in practice.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:46Contents
- 1:58Motivation High integrity and high value artifacts only go to high integrity clusters Ads serving as an example
- 3:21Pipelines isolation and hardening
- 5:47Context: Policy Engine
- 7:08ORCA
- 8:53Deploy Manifest Output artifacts Manifest detail
- 14:22Demo Takeaways
- 17:18Open Policy Agent: A CNCF Project Make Policy a First-class Citizen
- 18:15OPA's General-purpose Policy Engine
- 20:46Policy Development Life Cycle and OPA Tooling
- 27:13Main points to take home
related talks
24mAutomating Enterprise/Industry Regulation Enforcements During Software Delivery
20mUsing OPA to Ensure Compliant Software Delivery in a Highly Regulated Finance Envi...
08mAutomated & Immutable Spinnaker Deployments with Security...
33mAutomating Industry Regulation (SoX, SoC 2) Enforcement...
19mDo's and Don'ts for Securing and Governing your Spinnaker Environment
15mIntegrating Fortify Security Scans in Spinnaker Pipelines
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
25mOpen Policy Agent as a Control Engine