Deep Dive: CNCF Security SIG – Justin Cappos, New York University & Zhipeng Huang, Huawei
summary
CNCF Security SIG performs public, high-level security assessments (20–30 hours to draft, ~1–2 engineer weeks total) of projects like TUF/Notary, SPIRE/SPIFFE, OPA, Falco and in-toto to surface deployable risks and scope deeper audits; assessments inform threat models and tooling choices. Practical findings: TUF integrates with a one‑time setup cost then runs transparently, OPA centralizes policy with operational overhead, in-toto provides verifiable software provenance, and policy work targets richer semantics and verification via eBPF/Cilium and Gatekeeper-style compilers.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:50Security Assessments
- 5:17Security Projects
- 9:07Security Assessment
- 12:40Security Landscape
- 13:15Security SIG Projects
- 15:53Policy
- 18:21History
- 18:33Motivation
- 19:57Architecture
- 21:14Whitepaper
- 21:37Case Studies
- 21:49Policy Working Group
- 23:14Policy Semantics
- 26:32Weekly Meeting
- 26:52Community Focus Talk
- 32:15Governance Process
