Supply Chain Security - PSResourceGet...
summary
A concrete plan surfaces: publish PowerShell modules into Azure Container Registry to block typo‑squatting and give vendors exclusive, signed locations; register a repo with register-PSResourceRepository, publish modules (demo shows find and publish succeeding using Azure identity), and use oras copy to mirror public images into private ACRs. Docs and an ADMX/ADML group‑policy path exist to enforce repositories. PSResourceGet currently uses the open container distribution spec (not ORAS yet). Scale concern noted: millions of servers polling every 15 minutes.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:59Security feedback driving change
- 4:46OCI artifacts explained
- 8:00Three-tier supply chain security
- 10:26Demo setup and ACR basics
- 21:11Azure identity and ACR security
- 24:21Connected registries and future plans
- 28:01Artifact Registry and caching rules
- 33:28Mirroring versus caching
- 36:18Q&A
- 43:43Closing remarks
related talks
42mPSResourceGet in Restricted Environments: Air-Gap, ACR, and Modern...
48mPrivate Galleries
47mBest-practices for securing your Azure Container Services
27mNever Break the Chain: Securing the Container Supply Chain with Notary, TUF, and Gatekeeper
43mSecuring container deployments on Azure Kubernetes Service with open-source tools
41mCloud-Wide Contamination: Chaining SSRFs for Tenant Compromise in Azure (CVE-2025-29972)
46mSecuring the Containers’ Supply Chain for Azure Kubernetes Service
52mPentesting Azure Container Services