Operating Tekton with Secure Defaults
summary
Five concrete secure defaults: run Tekton Chains to generate provenance (requires type hints), enforce provenance-at-deploy with Kyverno or the Sigstore policy controller, enable remote resolution so Tasks/Pipelines live in version control, add sandboxing (GKE Sandbox / gVisor / Kata) to stop pod escapes, and publish a signed, curated catalog with Trusted Tasks so only vetted Tasks/images run; team also rebuilds public images, pins image versions, and adds SBOM/image-scanning Tasks to pipelines.
AI-written summary · about
chapters (13)
- 0:00Tekton with secure defaults
- 1:47Peanut’s prior Tekton setup
- 2:28First project and meowing incident
- 3:11One run Tekton Chains
- 4:13Require provenance for images
- 5:15Build as code
- 6:40Pod escape exploits and sandboxing
- 8:48Enable sandboxing for tasks
- 9:08Secure catalog for trusted tasks
- 10:11Implement trusted catalog
- 11:37Future plans for TDL’s CI/CD
- 13:42Five secure defaults summary
- 14:27Q&A on catalog policies
related talks
14mOperating Tekton Efficiently and Securely for multi-team use cases
22mCloud Native Supply Chain Security with Tekton and Sigstore
18mLet Devs Be Devs Without Sacrificing Security
15mTekton State of the Union
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
34mProtect your software supply chain with Tekton and Sigstore
18mA Secure Tekton Task by Using Confidential Containers
30mTekton Chains in Action