Fun with Continuous Compliance
summary
Shopify describes running thousands of GKE clusters and thousands of builds per month and shows a concrete pipeline: Buildkite builds images, images are scanned in GCR, metadata lives in Grafeas, and voucher signs images that pass checks. Binary Authorization/Kritis blocks unsigned images at deploy time. Google frames OSCAL as a way to convert YAML/XML scan and policy outputs into OSCAL machine-readable evidence so GRC tools can ingest continuous compliance artifacts and reduce audit paperwork.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:06The Fun Scale
- 6:17Why Continuous Compliance?
- 9:56Production Build Pipeline
- 10:31Binary Authorization and Voucher
- 15:24Snakeoil flow
- 20:50Common asks from our customers
- 21:40How does OSCAL help
related talks
28mKnow Your Kubernetes Deploys
40mSecuring Shopify's PaaS on GKE [I]
31mSecuring the Deploy Pipeline
30mSoftware Supply Chain Management with Grafeas and Kritis
36mSecure your software supply chain from dependencies to deployment
48mBuilding GDPR, ISO27001 Containerized Application for continuous compliance
46mA Security State of Mind: Continuous Security with Kubernetes
32mGRC Engineering - Bringing GRC to a repository near you