Image Provenance and Security in Kubernetes
Talkat Cloud Native Security Day Europe 2020 · on Monday, 2020-08-17· at 14:25· InXpo, https://onlinexperiences.com/Launch/Event.htm?ShowKey=99259·
summary
Kubernetes clusters often lack provable provenance: 4,000 apps were tainted by XcodeGhost, S3-hosted Twilio SDK was replaced, and SKS keyservers are unreliable. Practical fixes include using Notary v2 for registry-integrated signing (Notary v1 is mostly unmaintained), relying on keys.openpgp.org instead of SKS, running vulnerability scans with Trivy, and storing image metadata/attestations in Grafeas. Container Solutions publishes trow registry with an admission controller to allow only curated images; reproducible builds require pinned base images, checksums or signatures, and build tools like Bazel.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 3:12Supply chain risks and failures
- 9:07Current verification challenges
- 12:41Future solutions and Notary v2
- 14:43Image identification and labeling
- 18:17Rebuilding and reproducibility
- 21:50Vulnerability scanning and updates
- 23:35Registry control and admission
- 24:15Emerging tools and standards
- 28:55Key takeaways and actions
related talks
30mEstablishing Image Provenance and Security in Kubernetes - Adrian Mouat, Container Solutions
34mMake the Secure Kubernetes Supply Chain Work for You
36mEnforcing a Secure Supply Chain on Kubernetes
46mA Security State of Mind: Continuous Security with Kubernetes
20mTrust but Verify
37mSupply Chain Security in Kubernetes
28mKnow Your Kubernetes Deploys
38mTutorial: Building Security into Kubernetes Deployment Pipelines