Signed, Sealed, Delivered - Sign and Verify All the Things
Talkat KubeCon + CloudNativeCon Europe 2025 · on Wednesday, 2025-04-02· at 16:15· Level 0 | ICC Auditorium·
summary
Mirrors every external image into a controlled OCI registry, signs artifacts, scans and patches vulnerable images, and enforces acceptance in-cluster using ORAS, Notation, Flux, Kyverno plus Zot, Trivy, Copa and GitHub Actions. The demo reveals one image with 394 high and 61 critical vulnerabilities, shows images retagged and signed, fails admission until a missing notation secret is created, then Flux reconciles and the 2017 emoji-vote app deploys (service reachable though leaderboard UI is flaky). Policies reject unsigned registry sources and allow granular trust adjustments.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:06Early container challenges
- 3:36Third-party registry risks
- 5:43Supply chain security best practices
- 6:48OCI artifacts benefits
- 8:10Verification chain of custody
- 9:34Tools for signing and verification
- 11:19CNCF supply chain stack
- 12:21Trust policy configuration
- 13:28GitHub Actions for signing
- 16:13Kubernetes cluster with Zot
- 17:41Customizing manifests
- 18:28Installing Flux
- 19:11Deploying Kyverno
- 20:35Kyverno policy configuration
- 22:00Publishing Flux to OCI
- 23:48Deploying emoji app
- 27:25Final demo and recap
- 29:52Conclusion
related talks
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
31mSign, Attest, and Verify! A Practical Guide for Software Supply...
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge
42mDid you sign this (image)?
26mWho's Verifying Your Signatures? Approaching Private Container Image Signing
35mEnforcing a Secure Supply Chain on Kubernetes
37mNotary: State Of Development
27mSecuring your Software Supply Chain on Kubernetes with Sigstore