Leverage Kubernetes SPDX Tools to Create Your SBOM
summary
Kubernetes release automation produces dozens of artifacts (about 30 images, 53 binaries across six architectures and three OSes) and the team builds an SBOM pipeline around the bom tool that scans Go modules, reads image registries and layers, and emits spdx tag:value output. The pipeline runs in a Tecton CI job, uses a 474-license classifier with ~97% license accuracy, and calls cosign to attach signatures. Declarative YAML drives complex SBOMs; RPM/DEB analyzers and SPDX library integration are work in progress.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:36About Adolfo
- 1:54Kubernetes Release Overview
- 3:48Kubernetes Release Tools
- 5:02What is a SBOM
- 7:24Example of a SBOM
- 8:25Organize your SBOM better
- 9:27Leverage SPDX features
- 11:08BoM
- 12:48Demo
- 21:18Future direction
- 23:08Questions
related talks
33mWe Built the Kubernetes SBOM and Now You Can Write Your Own!
38mThe State of SBOMs
31mHardening the Kubernetes Software Supp...
35mTransforming SBOMs from Compliance Burden to Security Asset
36mSBOMs, VEX, and Kubernetes
43mUsing SBOMs for Linux Foundation Projects
35mFrom Kubernetes With ♥ Open Tools For Open, Secure Supply Chains
26mAn OSS project's attempt to secure it's supply chain