Protect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
summary
Shows a concrete pipeline security stack that is implemented and demoed end to end: Tekton pipelines pack into Tekton bundle + cosign signed OCI artifacts, attested with in-toto and stored in OCI registries, and validated at admission time by Kyverno policies enforce signatures that also generate namespace defaults, PVCs and enforce step-level nonroot and vulnerability predicates. Demo runs a full build/scan/sign/attest/deploy flow, blocks unsigned bundles and high-severity steps, and completes successfully.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:08Tecton Bundle
- 7:06Pipeline Definitions
- 12:27Demo
- 13:06Run this Pipeline outside of a Namespace
- 19:07Verifying Signatures
- 22:54Unsigned Pipeline
related talks
10mIt's Time We Start Securing Our CICD Pipelines
18mLet Devs Be Devs Without Sacrificing Security
40mPolicy Driven Approach to Secure Your CI/CD Workflow
33mSecuring Your Infrastructure as Code Pipeline
38mSecuring your CI/CD Pipeline
19mWho Are You Building For: Pipelines Have a Purpose
48mSecuring Your Pipes with a TACO
37mIs Your Approach to Pipeline Security Flawed? Rethinking CI/CD Security