Securing Kubernetes Manifests with Sigstore Cosign, What Are Your Options?
summary
Three concrete options for verifying Kubernetes manifests signed with Sigstore Cosign: a kubectl plugin that packages a YAML as an OCI image, signs it with a local private key and stores signature annotations so the plugin verifies before apply (beware mutable fields like replicas); an admission-controller approach (Kyverno/Gatekeeper) that rejects unsigned images by checking Cosign public keys in secrets; and Flux pulling OCI/Helm charts that verifies Cosign signatures at sync time and deploys only verified bundles.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:28What is Software Supply Chain
- 5:03Container Image Workflow
- 7:55Cosign
- 10:17Kubernetes Manifest
- 12:54Cluster Policy
- 14:42MChart
- 16:40Flex
- 19:47Conclusion
related talks
22mSecuring Kubernetes Manifests with Sigstore and Kyverno
36mEnforcing a Secure Supply Chain on Kubernetes
17mImprove Security in Kubernetes
40mSigstore: How We Started, Where We Are, Where We are Headed
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
35mEnforcing a Secure Supply Chain on Kubernetes
42mDid you sign this (image)?
40mEnforcing a Secure Supply Chain on Kubernetes