Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

Trust But Verify: Bringing Supply Chain Integrity to CD GitOps

CNCF [Cloud Native Computing Foundation] via YouTube

Overview

Explore a conference talk that delves into enhancing supply chain integrity in Continuous Deployment (CD) GitOps for Kubernetes cloud native applications. Learn how to address the lack of supply chain controls in GitOps automation, which currently fails to ensure integrity and tamper-proof deployments. Discover the challenges of applying typical signing and verification methods to Kubernetes manifests composed from multiple source assets and subject to template-based mutations. Gain insights into extending CD GitOps processes to provide verification of source assets with cluster enforcement of signatures and policy permissions. Understand how combining keyless signing via Sigstore and intersecting control points throughout GitOps can achieve accurate cryptographic signing of source assets and produce transparency of configuration provenance. Explore the use of admission controllers like integrity shield for validating pipeline integrity through cluster enforcement.

Syllabus

Trust But Verify: Bringing Supply Chain Integrity To CD GitOps - Yuji Watanabe & Hirokuni Kitahara

Taught by

CNCF [Cloud Native Computing Foundation]

Reviews

Start your review of Trust But Verify: Bringing Supply Chain Integrity to CD GitOps

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.