Simplifying Kubernetes: Streamlining Secure App Deployment in DevSecOps
summary
Shows a concrete pipeline that ties Kubernetes deployments into Red Hat’s trusted supply chain using Sigstore (cosign/fulcio/rekor) for artifact signing and attestation, Tekton Chains + OpenShift Pipelines for automated build attestations, and Argo CD with Enterprise Contract to enforce SLSA levels (four levels mentioned). It generates SBOMs, auto-rotates short lived keys for commits, uses StackRox/Red Hat Advanced Cluster Security for continuous runtime checks, and provides Backstage templates so developers push code without manual signing.
AI-written summary · about
chapters (6)
- 0:00Introduction to supply chain security
- 3:34DevSecOps evolution and responsibilities
- 7:03Shifting left security in development
- 10:40Deployment phase and registry scanning
- 13:52Developer workflow with Sixto
- 17:48Demo and implementation overview
related talks
36mEnforcing a Secure Supply Chain on Kubernetes
15mEnforcing a Secure Supply Chain on Kubernetes
46mA Security State of Mind: Continuous Security with Kubernetes
35mEnforcing a Secure Supply Chain on Kubernetes
38mTutorial: Building Security into Kubernetes Deployment Pipelines
25mSecuring Kubernetes Multi-Tenancy: Navigating Challenges Through DevSecOps Control and Visibility
37mSupply Chain Security in Kubernetes
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack