Tutorial: Building Security into Kubernetes Deployment Pipelines
summary
Hands-on demo of signing images with Notary and scanning for CVEs, using a local registry and Katacoda lab instances; pipeline steps run manually to show integration rather than a full CI build. Shows image signing with Notary, Clair vulnerability scanning and a mutating admission controller that rewrites tags to content digests so Kubernetes only runs verified content. Uses a Harbor-style registry and kube-security webhook grading; demos succeed (some steps require waiting for lab instances). Continuous scanning and signature verification are enforced.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:10Stages of the CDLC (Container Delivery Lifecycle)
- 6:43Build Flow
- 10:59Image vulnerability scanning approaches
- 11:32Clair vs. MicroScanner vs. Anchore
- 16:57Extensible Admission Controllers
- 22:44Minimum viable security
- 23:48Threat Model
- 35:45Vulnerable images
related talks
30mA secure journey on Kubernetes
46mA Security State of Mind: Continuous Security with Kubernetes
35mEnforcing a Secure Supply Chain on Kubernetes
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
20mSimplifying Kubernetes: Streamlining Secure App Deployment in DevSecOps
41mBuilding Developer Pipelines with PKS, Harbor, Clair, and Concourse - Thomas Kraus, Merlin Glynn
37mAchieving High Security at Scale with Microservices
34mSecuring your Kubernetes Delivery Pipelines with Notary and TUF