Know Your Kubernetes Deploys
summary
Shopify enforces deploy-time signatures on container images so only artifacts that pass precomputed checks can reach Kubernetes: Kritis (binary authorization), a metadata server Grafeas, and an open-source attester voucher that runs Clair scans, verifies CircleCI test coverage, registry provenance and non-root status, then creates PGP attestations. Ubuntu 14.04 example (>30 high/critical CVEs) motivates constant rescans or rebuilds; a locked “break-glass” annotation pages security instead of disabling enforcement.
AI-written summary · about
chapters (9)
- 0:00Start
- 2:00Mutability is the enemy.
- 2:48Containerized infrastructure
- 5:53When to make the decision
- 7:25kes admission controller
- 9:18Kritis gating deploys
- 11:48Voucher runs checks
- 15:48Break-glass
- 18:59Do you have any questions?
related talks
31mSecuring the Deploy Pipeline
46mA Security State of Mind: Continuous Security with Kubernetes
37mSupply Chain Security in Kubernetes
40mFun with Continuous Compliance
31mImage Provenance and Security in Kubernetes
30mA secure journey on Kubernetes
34mMake the Secure Kubernetes Supply Chain Work for You
37mAchieving High Security at Scale with Microservices