►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18)
Grafeas Community Meetup BOF - Wendy Dembowski, Google (Any Skill Level)
Grafeas is an open source project whose goal is to provide organizations with a central source of truth for tracking software artifact metadata across an ever growing set of software development teams, pipeline, and technologies (see grafeas.io and github.com/grafeas).
This meet-up is an opportunity to meet in person and discuss community collaboration opportunities and priorities for the project. Topics we may discuss include: extending the types of artifacts and metadata we support, metadata signing, Kubernetes integration, hybrid cloud stories, etc.
About Wendy Dembowski
Wendy is a Staff Software Engineer at Google. She is a co-founder and the Khaleesi of Grafeas.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
There
are
still
some
missing
features
from
the
open
source
project
around
off
and
Ackles.
We've
talked
about
this
before,
but
those
are
so
things
that
need
to
be
built
out
and
then
we're.
We
recently
started
talking
about
having
a
QA
type
of
metadata,
which
is
under
specified
right
now,
because
I
don't
know
exactly
what
we're
trying
to.
B
What
we
we
initially
discussed
about
it
was
that
we
wanted
to
use
graphics
to
store
a
bunch
of
metadata
about
all
the
things
in
our
pipeline,
basically
not
just
the
vulnerabilities
and
scanning
and
things
like
that,
but
also
test
runs
and
when
they
pass
and
and
and
whatnot,
and
basically
produced
a
huge
amount
of
a
bunch
of
metadata
around
the
whole
pipeline.
But
it
sounds
as
though
that
overlaps
with
some
of
the
things
in
in
toto.
So
if
I
understood
it
correctly,
at
least
so
that's
clear,
my
kind
of
use
case,
I
guess.
A
C
Something
something
that
I
didn't
cover
in
the
talk
earlier
is
a
concept.
We
call
inspections,
those
are
tests
that
are
executed
upon
verification.
So
you
have
your
steps
of
the
supply
chain
that
do
things
like
take.
The
code
build
the
code
run
QA,
and
then
you
can
define
any
sorts
of
inspections
where
you
would
inspect
the
metadata
from
the
steps.
For
instance,
if
you
have
a
testing
step
and
the
link
metadata
pieces
for
it,
you
can
inspect
the
return
values
of
the
tests
in
your
inspection.
C
D
Covered
already
yeah
I'm
interesting
two
things
really
one
is
the
process
for
defining
the
schemas
either
they
get
extended
or
the
kind,
and
and
also
as
an
engineer,
I'm
interested
in
pipelines
as
well
I'm
interested
in
using
something
that
graphics
to
say
things
like.
Okay,
the
tests
passed.
There
was
90%
coverage
whatever
it
is
that
we
care
about,
but
then,
as
a
cog
in
an
enormous
bureaucratic
machine,
I
a
highly
regulated
one
I
should
add.
It
would
be
useful
to
be
able
to
also
collect
evidence.
A
D
A
A
A
I
think
one
around
with
a
waiver
that
were
referencing
storage
is
very
specific
to
Google,
because
this
project
came
out
of
Google,
so
have
an
open
issue
to
fix
that,
but
the
like
adding
new
fields
we
generally
just
start
with
a
proposal,
and
then
we
talk
through
what
the
what's
actually
needed,
which
is
sort
of
where
the
QA
thing
is
right.
Now,
like
there's
an
open
proposal
with
a
bunch
of
questions
in
it,
and
people
are
welcome
to
put
ideas
there,
I
did
mention
if
it
gets
too
messy.
A
I'm
ger
move
everything
to
Google
Docs,
so
we
can
sort
of
collaborate
more
easily
than
going
through
a
github
issue.
So
starting
a
proposal
is
fine.
I
think
we
may
want
to
start
to
think
about
extensions
to
the
graphics
API
so
that
not
every
not
everything
quite
fits
in
the
same
in
the
same
schema.
So
you
know,
while
you
might
need
test
details
and
code
reviews,
other
other
places
might
have
strict
policies
that
code,
that's
unreviewed,
can't
can't
even
be
committed.
A
A
E
Hey
so
my
question
is
about
like
what
is
the
end
goal
of
the
project
like
I
would
like
to
see
like
a
ago
feels
like
it's
mission.
Control
plug-in
kubernetes
like
I
want
a
way
to
say,
like
I.
Don't
want
like
images
that,
like
have
specific
vulnerabilities
or
specific,
like
test
failed
I,
don't
want
it
in
production
and
don't
want
I
mean
this.
This
namespace
that
namespace,
like
I,
want
this
component
like
deposit
I,
don't
see
this
component
currently
like.
So
what
are
the
plans
to
integrate
it
exactly?
A
So
we
have
the
the
attestation
x',
which
are
the
fields
that
are
meant
to
be
called
by
the
admission
controller.
So
the
anticipation
we
use
that
because
we
don't
want
to
put
a
lot
of
logic
in
the
admission
controller,
so
it
should
be
just
quick.
Does
this
thing
exist
or
not
so
the
the
language
to
define
what
what
add
test
Asians
are
required
is
something
that
we
need
as
well.
As
you
know,
a
more
generic
aggression,
controller
I
think
longer
term.
Those
are
things
that
we
definitely
want
to
build.
F
So
I
am
also
from
Google,
so
I
are
working
on
something
to
use
the
other
stations
in
the
admission
controller.
To
do
exactly
that,
we
are
in
the
stage
of
defining
what
explicit
ivities
we
really
need
so
we're
currently
in
an
alpha.
So
if
you're
interested
in
in
doing
that
like
in
indicate
yes
talk
to
me
later
soon,
we
can
begin
get
that
set
up.
So
where
we're
trying
to
figure
out
what
the
requires
really
are
to
make
sure
like.
We
don't
try
to
boil
the
ocean
while
like
creating
something
in
salt
and.
G
H
Yeah,
so,
okay,
sorry,
so
the
question
is:
is
that
you
have
docker
images
that
you're
doing
with
notary,
and
you
want
to
integrate
it
into
something
like
graffities
I,
don't
know
specifically
about
graffitis
integration,
but
you
can
integrate
into
in
toto
and
in
toto
is
hopefully
going
to
be
integrated
into
graffities.
So
as
a
result
of
that,
then
maybe
transitively
when
that
happens,
that'll
all
work
together,
but
today
the
in
toto
and
and
notary
or
in
toto
and
tough
part,
already
works.
I
Hey
John
pulse
for
Shopify
were
part
of
the
Alpha.
That
Wolford
was
talking
about
the
emission
controllers
and
stuff
and
we're
just
trying
to
really
define
our
policies
of
what
it
takes.
What
what
can
we
store
interface
and
what
can
we
make
policies
for,
and
how
can
we
admit
our
control
I
admit
our
images
into
into
our
clusters
so
I'm?
Having
all
these
all
these
funny
thoughts
you
mentioned,
like
notary,
right,
I'm
having
to
grow
face
and
like
will
thought
would
be
like
hey.
I
Can
we
just
tore
the
notary
server
alongside
the
image
metadata
to
be
like
hey?
This
is
where
this
image
is.
The
notaries
really
need
to
go
talk
to
to
validate
that.
This
images
of
thing,
Felix's
and
I
guess
say:
I
think
he
is
more
work
than
I.
Do
are
really
talking
about
we're
the
security
team
for
what
it's
worth.
So
how
can
we
store
in
graffia
things
like
capability
drops,
maybe
something
that
falls
outside
the
scope
of
POD
security
policy
right?
I
So
we
can
check
in
graffia
city
like
which,
which
capabilities
do
we
need
to
drop
on
this
container
before
it's
run,
and
then
you
know
sort
of
form
you
take
mutating
a
mission.
Maybe
we
could
do
it
in
such
a
way
that
we
could
drop
capabilities
on
the
fly
or
something
like
this
right?
Does
the
container
run
his
route?
These
are
sort
of
policies
that
we
would
create,
leveraging
the
metadata
ingre
fayus.
How
can
we
further
store
them
in
graffia?
J
J
When
was
it
last
run?
Has
it
become
vulnerable
with
in
a
lot
like,
since
it
has
been
deployed,
then
to
like
then
pull
it
out
of
GK
and
replace
it
yeah?
Those
are
questions
we've
been
thinking
about,
and
it's
like
I
have
answers
to
all
those
questions
which
concern
darker
images.
What
I'm
really
unsure
about
is
the
because
docker
images
are
immutable,
so
like
creating
annotations,
for
them
is
easy
just
like
during
build
time,
you
create
the
attestation
and
the
attestation
stays
there.
J
I
Yeah
I
guess
like
an
overarching
concept
for
us,
is
like
it's
like
graph
is,
and
these
at
the
stations
is
more
like
the
entrance
criteria
for
an
image
and
like
sort
of
what
what
pieces
of
the
puzzle
are
required
to
admit
an
image
into
our
clusters.
But
what
does
exit
criteria
look
like
and
what
is
that?
What
does
that
mean?
This
is
something
that
we've
been
sort
of
thinking
about
for
last
little
while
as
well
more
than
happy
to
chat.
If
anyone
has
any
questions.
B
The
stuff
you're
talking
about
about
capabilities
and
things
like
that,
would
be
something
we've
been
teresting
into.
We
as
part
of
exploring
this,
a
colleague
of
mine,
builds
a
tool
that
scans
your
pods
Yama's
and
gives
you
a
score
about,
like
security
related
stuff
like
how
you've
configured
it,
which,
which
is
which
is
cool
but
like.
Ultimately,
this
kind
of
thing
belongs
in
in
animation,
controller
type
function,
but
driven
driven
out
of
information
on
graph,
yes
and
tied
all
into
the
same
API
is
and
stuff
like
that
would
be,
or
will
be
awesome.
Yeah.
K
And
and
for
the
exit
criteria,
as
long
as
you
keep
track
of
the
image
that
the
containers
are
created,
you
can
always
reach
check
the
images
when
you,
when
your
abilities
are
discovered,
and
then
you
will
know
that
you
have
a
vulnerable
container
interest.
The
question
is:
what
are
you
doing
with
it?
Should
it
decommission
and
stop
the
service,
or
should
you
continue
probably
should
rate
the
Venerable?
It
is
basic
on
the
severity
of
it
and
then
make
a
decision.
That's
all
the
fun,
but
someone
you
already
commissioned
commissioned
the
service.
K
A
L
Have
a
couple
of
topics
that
might
be
of
interest
to
discuss
one
being
search,
so
there
have
been
some
contributions.
There
see
what
the
state
is
for
that
and
then
I
was
thinking
about
Claire
integration,
I've
had
a
couple
of
people
come
up
and
talk
to
me
about
Claire
integration
here
for
vulnerabilities.
L
A
I
can
talk
about
the
search
contributions,
because
that's
all
just
waiting
for
me
to
do
it's
the
so
we
have
a
filter
parser
already
in
place
and
we
just
actually
need
to
start
passing
filters
to
it
and
then
map
those
to
sequel.
So
all
the
code
I
think
the
the
hard
part
of
this
was
written
by
someone
on
the
open
policy
agent
team,
where
they're
using
cell
to
parse
the
purse
the
filters
and
then
they
they
have
some
stuff
that
will
help
us
do.
The
mapping
from
this
is
a
filter
string
passed
into.
A
L
A
L
The
the
Claire
integration
right
now
it
exports
CDs
into
to
graph
dance.
So
that's
fine,
but
as
we
have
the
discussion,
it's
it's
harder
to
so
these
these
are
notes
in
in
graphics,
language.
It's
hard
with
the
occurrences
because
the
it's
like
who
is
the
project
owner
who
is
allowed
to
do.
This
would
be
easy
enough
to
write
a
simple
script
that
just
lists
vulnerabilities
and
writes
them
to
graph.
Yes,
but
a
more
general
solution
that
would
work
in
when
you
have
multiple
users.
That
would
require
some
some
more
some
more
work,
so
yeah.
L
L
D
A
My
team
at
Google
has
eight
people
and
they're
sort
of
part-time
everyone.
Sort
of
programming.
Gruffy
is
per
time
on
some
other
stuff.
Tobias
has
been
a
huge
contributor
from
the
beginning
and
we
have
a
few
other
external
developers
who
are
contributing
things
so
right
now
the
the
actual
contributor
community
is
somewhat
small
and
so
that
we
can
have
bi-weekly
dev
cards
that
usually
last
10-15
minutes
just
to
sync
up
and
see.
A
So
my
team
at
Google
has
been
working
on
defining
the
proto
and
there
we're
going
to
be
working
on
implementing
the
beta
version
of
the
API.
But
there
are,
there
are
a
few
places
where
there's
definitely
room
for
contributions.
Around
blake
of
people
have
opinions
how
we
should
do
off,
which
will
probably
be
off.
A
Then
that's
exciting
in
great,
and
you
know
we're
happy
to
take
those
contributions,
but
the
general
process
for
anything
is
create
an
issue
and
then,
if
it's
something
small
and
clicked
to
fix,
just
fix
that
or
if
it's
like
a
very
tiny
fix,
just
send
a
PR
and
then
for
larger,
larger
proposals
and
issues
create
a
an
issue
tag
proposal
and
just
write
your
proposal
on
it.
And
so
it's
generally
how
we've
operated
I
think
it's
worked
fairly
well
up
to
this
point.
A
K
A
K
L
L
K
A
K
D
B
It
wasn't
as
mean
clear
to
me
from
looking
at
the
docs
and
things
like
that,
how
to
get
like
the
vulnerabilities
in
information
into
there
so
I'm
guessing.
This
is
what
the
Claire
integration
is
driven
by.
No,
it's
a
way
to
play
with
it
without
you
know
like
to
a
stock
license,
or
something
like
that
he's
is.
That
is
that
what
that's
for
is,
that
is
that,
is
that
documented
somewhere
am
I
just
dense,
where.
A
L
L
Exactly
so,
but
I
did
it
as
integrated
into
Claire
ass,
because
otherwise
you
would
have
to
add
more
api's
to
Claire,
because
Claire
doesn't
expose
all
the
CDs
and
also
I
think
it
makes
sense
to
add
it
as
a
plug-in
but
I
think
probably
we
need
a
more
complete,
complete
solution
before
this
get
ex
updating
to
Claire,
but
the
chorus
guys
seem
to
be
interested
in
and
at
some
point
they
were
also
thinking
about
contributing
some
some
work
to
this
as
well.
But
it
seems
to
get
a
lot
of
things
happening
at
core
right
now.
L
A
D
A
Also
had
contributions
firm,
Red,
Hat
as
well,
that's
was
active
early
on
so
I.
Think
Red
Hat
is
also
interested
in
graphics,
or
at
least
some
people
at
Red.
Hat
are
interested
in
it.
So
I
don't
think.
There's
gonna
be
any
sort
of
pushback
on
the
Red
Hat
side
for
Claire
and
agreeing
with
gracias.
We
just
need
to
follow
up
on
that.
I
think
it
probably
just
got
lost
in
the
shuffle
of
your
own
stuff
and
yeah.