Securing your Kubernetes Delivery Pipelines with Notary and TUF
summary
Explains how Notary and TUF store signed docker image digests and how a mutating admission webhook queries Notary, replaces tag references with verified digests, and enforces signer pinning. Describes an open source controller called Portieris (GitHub) that talks to an IBM Cloud Notary server, installs as a Helm chart, and rejects all images by default until policies allow them. Demo shows docker trust key generation, pushing to Bluemix registry, automated mutation to digest and successful enforcement of signer-bound policies.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:05Security is hard
- 3:15What is Notary
- 5:10How does Notary work
- 8:05Admission Controllers
- 9:40Webhooks
- 10:40Mutating Webhooks
- 11:40API Server Response
- 13:40Port CRS
- 14:35Policies
- 28:00Wrap up
related talks
33mIntroduction to Notary
27mNever Break the Chain: Securing the Container Supply Chain with Notary, TUF, and Gatekeeper
29mTUF-en up Your Software Supply Chain
39mIntro: TUF / Notary
38mTutorial: Building Security into Kubernetes Deployment Pipelines
35mEnforcing a Secure Supply Chain on Kubernetes
32mNotary v2: Redesigning the Secure Supply Chain for Containers
36mEnforcing a Secure Supply Chain on Kubernetes