Securing the Deploy Pipeline
summary
Shopify describes a pipeline that signs container digests after CI builds, stores those attestations in Grafeas, and enforces them at deploy time with the Kritis admission controller so only images with required checks (vulnerability scans, nonroot, origin pipeline, etc.) run in clusters. Voucher is the attestation creator that calls scanners (Google/Clear), records results, and supports per-cluster policies, break‑glass auditing, and tag-to-digest resolution; it runs in production at Shopify and enables recall and redeploy when new vulnerabilities appear.
AI-written summary · about
chapters (6)
related talks
28mKnow Your Kubernetes Deploys
40mSecuring Shopify's PaaS on GKE [I]
40mFun with Continuous Compliance
16mKeynote: Securing Shopify's Software Supply Chain
37mA Secure Continuous Delivery Pipeline
38mTutorial: Building Security into Kubernetes Deployment Pipelines
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
37mAchieving High Security at Scale with Microservices