Policy Driven Approach to Secure Your CI/CD Workflow
summary
Live demo shows a full CI/CD pipeline using Tekton Pipelines as Code, ArgoCD, and Kyverno policies with cosign-based signing via Tekton Chains. A pipeline run annotated with maxKeepRuns=5 is rejected because the policy forbids values greater than three; editing the annotation to 2 lets the pipeline run, build, push, and cosign the image. ArgoCD deployment initially fails due to a mismatched public key, the key is corrected, and verification then succeeds.
AI-written summary · about
chapters (10)
- 0:00Policy-driven CI/CD security
- 3:42What is Tekton
- 11:07Pipelines as code for security
- 14:00Securing pipeline runs with Tekton Chains
- 15:48Argo CD for GitOps
- 17:57Kubernetes policies explained
- 21:59Demo: policy enforcement
- 24:28Validating with Kyverno
- 33:49Deploying signed images
- 39:39Conclusion
related talks
26mProtect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
34mFrom Code to Deployment: A Deep Dive into Pipelines as Code
10mIt's Time We Start Securing Our CICD Pipelines
18mLet Devs Be Devs Without Sacrificing Security
26mSecuring GitOps Supply Chain with Sigstore and Kyverno
25mPolicy-Based GitOps: How Policies Can Help Secure and Automate GitOps...
34mSecure by Default with GitOps - A Guide to OPA with Argo CD
30mTekton Chains in Action