Open Source Summit Europe 2022

A series of exploits and vulnerabilities made everybody aware about the importance of having a Secure Supply Chain story in place. But how hard is to implement a Secure Supply Chain and, most important of all, how to take advantage of it inside of our Kubernetes clusters? Moreover, how can we ensure our clusters stay compliant and how can we quickly assess whether we are running workloads that are affected by the latest CVE that has just been announced? This talk explains how to implement a Secure Supply Chain using Open Source projects, and enforce it in our cluster with an Admission Controller. In this updated talk we explain the Sigstore keyless workflow in detail, and we show the implementation of the signature verification policy.