Securing GitOps Supply Chain with Sigstore and Kyverno
summary
Demo shows a GitOps pipeline that builds images in Argo Workflows, signs them with Sigstore cosign and pushes cosign signatures pushed to GitHub registry, and enforces deployment with Kyverno so the admission webhook rejects anything without a valid signature. A hacked demo image triggers Kyverno to deny sync in Argo CD and stop deployment; number cited for SolarWinds impact is over 18,000 organizations, illustrating why end-to-end image signing prevents widespread supply-chain compromise.
AI-written summary · about
chapters (10)
- 0:00Introduction to devops team
- 1:31Demoing the app and workflow
- 6:35The security incident
- 8:27Supply chain attack overview
- 10:43Introduction to Sigstore
- 12:38Kyverno policy engine
- 14:16Securing the pipeline demo
- 18:02Verifying the secure pipeline
- 20:24Preventing further attacks
- 24:37Conclusion and call to action
related talks
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
27mSecuring your Software Supply Chain on Kubernetes with Sigstore
35mEnforcing a Secure Supply Chain on Kubernetes
22mSecuring Kubernetes Manifests with Sigstore and Kyverno
01h 27mSupply Chain Security Tooling
34mTrust But Verify: Bringing Supply Chain Integrity To CD GitOps
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
09mSecuring GitOps