Policy-Based Governance for End-to-End Integrity Control of...
summary
Claim: enable end-to-end integrity for governance policies by signing, securely distributing signing keys, and enforcing signature checks on clusters. Implementation uses Open Cluster Management with a k8s manifest signing tool to attach signature annotations, a hub-side templating flow that embeds and encrypts secrets via an external-secrets operator and templatized secret, and an admission controller called Integrity Shield that works with OPA Gatekeeper and Kyverno to block unsigned or modified policies. Demo shows unsigned policies marked non‑compliant and rejected; properly signed policies are admitted. Roadmap expands signing to other resources and Ansible playbooks.
AI-written summary · about
chapters (11)
- 0:00Start
- 5:56Open Cluster Management-Policy-based Governance
- 9:09Protect integrity of policy
- 9:58Policy signing
- 10:56Signature enforcement at cluster
- 12:02Enable Integrity Using Policy
- 13:22Enable integrity protection by policies
- 13:48Unauthorized policy is blocked
- 15:59Secret distribution hub
- 17:31Deliver key from Vault to target cluster
- 19:19Deliver key using policy template
related talks
34mTrust But Verify: Bringing Supply Chain Integrity To CD GitOps
22mSecuring Kubernetes Manifests with Sigstore and Kyverno
15mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
28mHow To Automate Your Governance Strategy for Hundreds of Kubernetes Clusters
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
35mEnforcing a Secure Supply Chain on Kubernetes
24mOne stop talk for kubernetes security !!