SLIM: Hydrating cloud-native CI/CD pipelines to securely access Google Cloud Platform projects

on YouTube ↗32m

" summary

Presents SLIM, a secret-less identity manager that replaces JSON service-account keys with context-attested credentials for GitLab CI running on Google Cloud: a lightweight client (preinstalled on runners) sends GitLab and GCP metadata to SLIM, which verifies signatures, checks job and instance IDs, enforces user-based access, and returns short-lived tokens or rotated keys stored in Secret Manager; deployed in production since 2019 (three years) and later migrated to Google Workload Identity Federation, eliminating no static secrets and removing the central key-storage but initially introducing a single-service dependency.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 3:28Continuous Deployment
3. 5:44Secret Storage
4. 10:49User-Based Access Control
5. 19:43Example of a Ci Pipeline
6. 22:42Security Minimum Requirements
7. 23:02Conclusion
8. 24:08Pros and Cons
9. 29:57Final Conclusion

" related talks

• 22mHow to Secure Cloud Machine IdentitiesKomal Dhull, Nathan Brahms · BSidesSF 2024
• 34mZero trust CI/CD pipelineAmit Dube · XConf Europe 2022
• 23mFully SaaS-Based DevOps with Terraform Cloud and GitLabMayank Tahilramani, Kelly Hair, Kawsar Kamal · HashiTalks 2020
• 30mCI/CD for Hybrid and Multi-Cloud CustomersChristopher Sanson · Google Cloud Next '18
• 41mSoftware Delivery Shield: securing the serverless software supply chainAndrea Martelli, Giuseppe Cofano · serverless @ localhost 2022
• 08mLightning Talk: Don't Wait, Secure your DevOps Processes Using Open Standar...Dov Hershkovitch · GitOpsCon North America 2022
• 36mSecure your software supply chain from dependencies to deploymentAbdellfetah Sghiouar · Øredev 2023
• 28mFederation and Zero Trust CI inDavid Nicholaeff · GitLab Commit San Francisco 2020