Cloud Native Supply Chain Security with Tekton and Sigstore
summary
A Tekton Task runs Kaniko to build and push an image and writes results (image URL and digest); Tekton Chains watches the TaskRun, extracts those results, uses sigstore/cosign and Rekor to sign images and store provenance, and produces an in-toto attestation. SPIRE provides SVID node/workload attestations so Chains verifies TaskRun results before signing, preventing post-run tampering. Demo shows cosign verification and Rekor lookup, yielding SLSA level 2 provenance and a path toward SLSA 3.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:52Tekton pipeline basics
- 4:57Tekton chains introduction
- 5:57Securing with Sigstore
- 7:03Addressing vulnerabilities
- 8:19Spire for identity
- 9:26Understanding SALSA levels
- 13:16Demonstration
- 20:53Conclusion
related talks
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
34mProtect your software supply chain with Tekton and Sigstore
30mTekton Chains in Action
23mSoftware Supply Chain Integrity with Sigstore
50mZero-Trust Supply Chain Security with Sigstore, TektonCD and SPIFFE
36mKubernetes Supply Chain Security: The Software Factory
38mRoad to SLSA3: Non-falsifiable Provenance in Tekton with SPIFFE/SPIRE
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...