From Kubernetes With ♥ Open Tools For Open, Secure Supply Chains
summary
Kubernetes Release Engineering aims for SLSA Level 3 compliance (targeted around Kubernetes 1.25) and delivers a reusable open toolset: a BOM generator called Bomb, an attestation collector named Holote, and signing integrated with Sigstore. The release pipeline already manages ~100+ projects, ~25 images, ~50 binaries and records ~240 dependencies; a 30–35 person release team runs monthly and quarterly cycles. March 2022 enables image signing; the GitHub Actions demo produces signed provenance attestations and SBOM-backed artifacts successfully.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:20Challenges of release
- 4:37Supply chain security
- 12:42Gain visibility into the supply chain
- 15:18Machine readable manifest
- 17:25Salsa overview
- 23:15Bomb
- 24:53Tecolote
- 30:06Demo
- 33:48Outro
related talks
28mLeverage Kubernetes SPDX Tools to Create Your SBOM
19mReleasing Kubernetes Less Often and More Secure – The SIG Release Update
33mWe Built the Kubernetes SBOM and Now You Can Write Your Own!
19mKeynote: Releasing a More Mature and Stable Kubernetes
20mSimplifying Kubernetes: Streamlining Secure App Deployment in DevSecOps
33mA Day in the Life of Kubernetes Release with Tools, Challenges, and Operations
32mDeep Dive: Kubernetes (Release) SIG
21mA Practical Guide to SIG Release Tooling for Kubernetes Subprojects