Establishing Image Provenance and Security in Kubernetes - Adrian Mouat, Container Solutions
summary
Demonstrates concrete failures and fixes for image provenance on Kubernetes: a GKE demo shows three nodes running three different image versions because mutable tags and default imagePullPolicy let old images persist; solution options shown are using image digests or setting imagePullPolicy=Always (or an admission controller that resolves tags to digests). Covers reproducible builds with BuildKit/Bazel, metadata via OCI annotations and labels, vulnerability scanning (Clair), and image signing/verification with Notary/TUF.
AI-written summary · about
chapters (26)
- 0:00Intro
- 2:42Its Before Lunch
- 9:14Default semantics
- 9:38Always pull images
- 10:42Docker Swarm
- 11:32The problem with image tags
- 13:25Flows
- 13:55How do we know
- 15:11How was it created
- 15:25Reproducibility
- 16:09Problems with Docker
- 17:43Hermetic Build
- 18:57Blaze
- 19:32Is the image updated
- 20:10Tension between reproducibility and stability
- 20:59Vulnerability scanners
- 21:38Flux
- 22:05Image Provenance
- 22:27Digests
- 23:39Notary
- 24:04Networking rules
- 24:52Distributed architecture
- 25:48Holistic solutions
- 26:40Securing supply chain
- 26:57Trout
- 27:42Wrap up
related talks
31mImage Provenance and Security in Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
35mThe State of Your Supply Chain
30mA secure journey on Kubernetes
20mTrust but Verify
34mMake the Secure Kubernetes Supply Chain Work for You
30mSecuring Kubernetes Multi-Tenancy
37mSupply Chain Security in Kubernetes