Tekton Chains in Action
summary
Tekton Chains captures and signs task runs and OCI images using a cosign keypair, emits SLSA provenance attestations, and attaches evidence as pipeline run annotations; a MiniKube demo builds an image with a kico task, pushes to a registry, and shows a signed tick on the tag while cosign verifies the attestation payload. Integrations shown include container scanning (Clair/Quay), Open Policy Agent checks, and optional GitOps deploy with Argo CD, all working end to end.
AI-written summary · about
chapters (8)
- 0:00Tekton Chains intro & supply chain
- 4:23Why supply chain security matters
- 8:42Shift left security
- 10:36Tekton and Kubernetes CI/CD
- 13:06Tekton Chains secures pipeline
- 16:21Demo: signing container images
- 22:01Integrating Tekton Chains with real applications
- 28:24Resources & closing
related talks
22mCloud Native Supply Chain Security with Tekton and Sigstore
34mProtect your software supply chain with Tekton and Sigstore
15mTekton State of the Union
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
16mOperating Tekton with Secure Defaults
23mSoftware Supply Chain Integrity with Sigstore
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...
47mTekton, a new approach to pipelines