Mind the Gap: Bridging Supply Chain Policy With Git-less GitOps and GUAC
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 14:15· Level 1 | Hall Entrance S10 | Room C·
summary
Live demo shows an exploited dependency introduced, an SPDX SBOM generated with Trivy and uploaded into OpenSSF GUAC which indexes dependencies so a single query finds Viper across clusters; GUAC marks it malicious, a speculative PR is auto-tested, then Flux Autopilot rolls an OCI-first Flux CD artifact to fleets without pulling from Git. Cluster bootstrap and recursive sync succeed at scale, one certifier pod briefly crashloops but the OCI/GUAC pipeline proves end-to-end remediation from detection to deployment.
AI-written summary · about
chapters (12)
- 0:00Introduction and agenda
- 1:59Cyber resilience overview
- 7:57Managing software vulnerability
- 9:09Introduction to GUAC
- 11:15Secure supply chain practices
- 13:35The role of SBOMs
- 14:52Security attestation and hygiene
- 17:33Advanced GUAC workflows
- 19:08Hardened CI/CD pipelines
- 22:05Git-less GitOps with Flux
- 26:02Live demo of GUAC
- 32:39Summary and future tools
related talks
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
10mCharting the Course for Secure Software Supply Chain with Guac-AI-Mole!
22mGitOps - The Magic Key to Cloud Native Security
23mGitOps: yea or nay?
26mGitOps: yea or nay?
30mDeclarative by Default, Secure by Design: GitOps as a Control Plane for Governance
06mFrom Policy to Production: Flux and GitOps as Governance Control...
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...