Climbing high — getting started with cloud native security through open source
summary
Practical starter for cloud native security that shows concrete tools and numbers: use Trivy (11k+ stars) to scan repos, images and YAML for vulnerabilities misconfigurations secrets and licenses, run the Trivy operator in-cluster to produce vulnerability reports and SBOM-like inventories, and export Prometheus metrics to build dashboards. Demo reveals an image with ~700 raw findings pared to 32 actionable issues via filters and shows GitHub Actions and Security tab integration so cluster admins can adopt scans without becoming security experts.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:51Background and open source work
- 3:15Climbing analogy for security
- 6:24Cloud native security challenges
- 8:30Case study on security integration
- 10:56Choosing security scanners
- 14:26Trivy overview and demo setup
- 17:58Live demo of Trivy scanning
- 27:11Operators and compliance scanning
- 29:58Integrating security into workflows
- 30:43Q&A and closing
related talks
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
34mIntegrating Cloud Native Security into the SRE culture
20m5 Open Source Cloud Native Security Tools
31mIntegrating Cloud Native Security into the SRE culture
19mFrom Code to Cloud: Embedding Security
39m5 Open Source Security Tools All Developers Should Know About
16mContinuous CVE Scanning with Trivy Operator
22mGitOps - The Magic Key to Cloud Native Security