►
From YouTube: Securing Kubernetes Manifests with Sigstore Cosign, What Are Your Options? - Mathieu Benoit, Google
Description
Securing Kubernetes Manifests with Sigstore Cosign, What Are Your Options? - Mathieu Benoit, Google
In this talk, we will explore the options to verify with Sigstore Cosign the provenance of Kubernetes manifests before actually being applied in your cluster. Attendees will learn how Sigstore Cosign integrates with Kubernetes to provide secure solutions for signing and verifying container images and resource manifests, configuration files, and other critical components, bundled as generic OCI images. We will also touch upon the use of GitOps tools like FluxCD and policy engines like Kyverno and Gatekeeper in combination with Sigstore Cosign to enforce security policies and prevent unwanted changes in your cluster. Whether you are a seasoned Kubernetes user or just starting out, this talk will provide valuable insights and tips about your options for verifying in Kubernetes your Kubernetes manifests signed by Sigstore Cosign.
A
A
A
We
will
go
through
a
very
quick
introduction
about
what
is
six
star
and
cosine,
and
we
will
review
the
workflow
of
a
typical
workflow
for
container
images
in
nature
with
cosine,
and
then
we
will
see
three
main
scenarios
to
verify
the
signature
of
your
communities
manifest
within
your
communities.
Cluster.
A
The
first
one
will
be
with
Sky
Vernon,
an
admission
controller
at
policy
engine
and
the
two
last
one
will
be
verifying
your
M
chart
or
your
oci
images
with
flux,
guitar
store
out
there,
but
first,
let's
make
sure
we
we
are
talking
and
defining
what
is
software
supply
chain
and
so
of
course,
reply.
Chinese
from
a
developers
perspective,
I
have
my
code.
A
My
source
I
will
trigger
a
good
I,
will
grab
some
dependencies
and
I
will
package
what
I
want
to
to
to
expose
to
my
consumer,
and
but
here
we
could
see
that
this
consumer
is
actually
consuming
these
package.
This
artifact,
in
our
case,
maybe
a
container
image,
but
we
know
that
it's
coming
from
the
white
place
right,
but
do
we
know
if
it's
what
the
owner
intended
to
provide
an
expose
to
me
as
a
consumer
right?
A
So,
let's
imagine
you
have
a
compromise
account
within
this
workflow
a
compromise,
build
process,
a
compromise
package
repository.
So
here
you
could
see
from
later
a
to
G
and
the
different
places
where
you
could
have
compromised
stage
and
steps
within
your
workload
and
and
that's
what
the
Searcher
the
dev
as
a
website.
I'm
sharing
here
is
defining
and
that's
a
notion
of
zero
trust
with
software
supply
chain,
and
actually
they
are
helping
us
out
there
and
to
meet
some
requirements
to
be
Seeker
within
our
software
circulation.
A
And
one
of
the
criteria
is
the
provenance,
the
provenance
of
dependencies,
the
provenance
of
code
provenance
of
packages
and
you
could
meet
the
different
levels,
such
as
one
two,
three
four
four,
depending
on
which
criteria
and
weakra
module,
meeting
right
and
provenance
is
part.
Part
of
that
so
very
important
as
a
reference
as
well
and
sixture
is
here
to
directly
answer.
This
need
of
I
need
to
guarantee
that
the
artifact
is
yes
coming
from
a
repository
or
registering,
but
actually
is
coming
from
the
owner.
Who
is
signature
right?
A
A
A
A
I
have
mentioned
oci
multiple
times,
so
let
me
maybe
Define
it
a
little
bit
or
CI
stands
for
open
container
initiative,
it's
under
the
Linux
Foundation
umbrella
and
the
goal
is
to
Define
standard
specification
around
what
is
a
container
image.
What
is
a
container
runtime?
What
is
a
container
registry
right
on
a
very
generic
way
and
not
just
talking
about
Docker
right
and
actually
an
oci
image
and
he
is
able
to
package
any
file.
A
communities
manifests
in
our
case
we
will
see
later
with
me.md
and
then
click4
MP3
file.
A
So
you
could
archive
or
vendor
and
package
any
file
within
your
oci
image
and
an
oci
registry
in
our
case
we'll
be
able
to
host
your
artifact
to
your
oci
image.
So
a
Docker
container
and
a
container
image
is
actually
an
ocm
image
right.
So
here
I
need
to
push
my
container
image
and
then
I
will
use
cosine
locally
I'm.
A
Taking
the
support
to
generate
my
key
pair,
the
public
key
and
the
private
key
locally
I
will
use
a
private
key
to
sign,
actually
sign
this
container
image
with
the
immutable
digest
of
this
image
and
I
will
verify
with
the
public
key
locally.
So
that's
a
typical
workflow
for
container
image
right
now,
with
this
walkthrough
when
I
want
to
guarantee
that
any
container
image
is
actually
signed
with
this
workflow
from
within
my
kubernetes
cluster,
and
this
cluster
is
actually
just
taking
and
accepting
these
container
images
signed
from
this
workflow
and
this
signature.
A
Sorry
about
that
I
will
I
will
use
an
admission
controller
and
in
our
case,
kailano
is
one
of
the
tool
you
could
use
right.
So
I'm
using
cosine
I
will
sign
with
my
container
within
my
container
registry,
and
my
container
image
is
actually
signed
in
my
Continental
registry
and
actually
Calvin
as
an
admission
controller
and
policy
engine
installed
in
my
cluster
via
a
policy
which
is
this
one
here.
A
I
could
Define
this
manifest
okay
journal
or
policy
cluster
policy,
where
you
could
see
this
verified
images
specification
for
any
container
images,
I
need
to
please
Kevin.
Could
you
check
that
this
container
image
is
all
actually
signed
with
this
public
right
store
in
this
case
in
a
secret?
It
could
be
in
a
KMS
from
your
cloud
provider
Etc,
but
here
we
are
making
sure
any
container
images
is
signed
with
this
public
very
important
for
container
images.
A
A
If
you
are
using
peniser,
there
is
the
same
approach
if
you
are
using
Cube
Garden
same
approach,
so
that's
a
typical
for
tool
that
you
have
for
container
images,
signature,
verification
right
now,
let's
talk
about
how
to
do
that
with
kubernetes
manifest
and
why
you
would
like
to
do
that,
and
actually
you
could
make
sure
that
any
kubernetes
manifest
a
deployment,
the
secret
config
map
name.
It
is
actually
coming
from
and
trusted
from
where
it's
coming
from
from
your
corporate
Corporation
Enterprise
and
within
your
workflow
in
your
software
supply
chain.
A
Actually,
there
is
a
first
approach.
The
first
approach
is
using
the
cube,
CTL
Plugin
or
signing
kubernetes
manifest
I
I
put
the
the
link
of
the
tool
out
there
and
the
typical
workflow
is
using
Cube
cctl6
store
sign,
choosing
my
yaml
file
in
my
manifest
and
targeting
my
oci
registry.
So
this
EML
file
will
be
stored
as
an
oci
image
and
will
be
signed
with
this
public
key
private
key
actually,
and
the
typical
walkthrough
is
verifying
right.
A
I
will
use
qctl
system
verify
verify
this
yaml
file,
targeting
this
oci
image
within
the
oci
registry,
with
this
public
key
right.
So
the
other
typical
scenario
and
workflow
for
using
signing
your
communities
manifest
as
a
side
note.
This
workflow
actually
is
a
six
door
sign.
Qctr,
6.
increment
will
actually
generate
and
two
annotations
so
message
and
the
signature
that
you
could
see
where
the
signature
will
be
stored
and
will
be
leveraged
then
by
the
verify
command.
A
So
just
that
you
know
that
ctml
file
is
immutable
right
as
soon
as
you
have
updates
with
this
resource
within
your
cluster.
Let's
take
an
example
about
the
replicas
of
a
deployment
or,
if
you
are
doing
some
limitation,
adding
annotation,
adding
label
adding
all
the
metadata
and
data
within
your
resource
actually
running
in
kubernetes.
That
could
be
a
bit
of
a
challenge
here.
A
So
you
need
to
to
be
aware
of
that
is
almost
maybe
the
only
one
verifying
this
workflow
here
by
using
the
plugin
Cube
CTS
external
will
be
able
to
actually
do
the
verify
at
admission
controller
when
actually
deployed
within
kubernetes
and
before
being
deployed
in
your
kubernetes
cluster.
Actually,
so
that's
a
typical
workflow,
and
here
is
a
cluster
policy,
and
earlier
I
mentioned
the
equal
cluster
policy
for
container
images.
Here,
that's
to
verify
the
signature
of
your
kubernetes
manifest
previously
signed
by
electricity.
A
Maybe
you
have
Auto
scaling
in
place,
so
these
values
are
mutable,
they
could
change,
and
you
don't
want
that
when
you
want
a
signature,
because
you
don't
want
the
resource
to
be
a
change
now,
let's
talk
about
M
chart
and
chart
is
one
of
the
way
to
package
or
manifest
kubernetes
manifest
out
there
right,
and
so
that's
the
second
approach.
I
would
like
to
illustrate,
and
let's
talk
about
the
typical
workflow
to
sign
your
end
chart
you
do
a
package
like
we
did
with
Docker
build
here.
A
It's
end
package
like
we
did
with
Docker
push.
There
is
n
push
to
push
this
actual
oci
image
and
chart
in
your
OCR
register.
I
will
generate
locally.
My
keeper
public
and
private
key
here
and
I
will
still
use
cosine
to
sign
this
oci
image
and
chart
actually
and
I
have
the
verify
Command
right
with
the
public
key
in
this
case,
pretty
simple,
similar
to
the
dockera
workflow
we
had
with
cosine
and
looker,
and
your
container
images
same
for
your
M
chart.
A
I
just
want
to
highlight
that
there
is,
when
you
do
n
package
this.
This
dash
dash
sign
parameter,
which
is
not
yet
supporting
cosine
I
share
at
the
bottom
of
this
slide.
The
link
of
the
issue,
mentioning
that
it's
coming
in
the
future,
where
you
will
be
able
to
actually
not
using
all
the
cosine
command
at
the
bottom
of
this
prompt
command,
but
you
will
be
able
to
use
n
package
sign
directly,
pretty
convenient,
and
so
just
for
your
information
that
in
the
future,
this
workflow
will
be
simplified.
A
A
More
generically
than
an
M
chart,
you
could
bundle
in
kubernetes
manifest
and
any
file
like
I
mentioned
earlier,
oci
images
again,
oci
stands
for
open
container
initiative
and
I
will
use
oras
or,
as
is
a
part
of
the
cncf
cloud
native
Computing,
Foundation
ecosystem
and
tools
and
projects
out
there
and
like
with
like,
we
did
Docker
push
or
n
push.
We
could
do
RS
push,
so
I
could
render
any
files
locally
from
the
current
folder
and
pushing
those
file
in
my
oci
registry
and
doing
an
archive
or
no
CI
image
within
this
OCR
register.
A
What
is
a
tool
again
to
validate
and
verify
the
signature
of
this
oci
image
within
my
cluster
before
being
admitted
and
deployed
in
the
crystal
corrects?
Is
the
tool
allowing
you
to
do
that
again?
Flux
is
able
to
pull
manifest
from
a
git
repository,
a
name
registry
or
more
generically,
and
no
CI
images
and
again
my
communities
manifest
will
be
done
there
as
an
oci
image
within
my
oci
registry
right
and
githubs
will
have
the
school
mechanism
here
is
a
manifest
where
you
could
Define
your
oci
repository
like
we
did
earlier
with
the
end
chart.
A
A
A
So
three
first
Links
of
some
of
my
own
experience,
but
I
have
been
sharing
about
kind
Runner
about
using
Cloud,
KMS
and
Coastline
and
policy
controller
and
other
talk
about
oci
and
githubs,
and
the
last
one
from
kerano
and
ecosystem,
which
is
a
more
specific
talk
about
the
cube
CTI
plugin
I
mentioned
during
this
talk
again.
I
hope
you
are
you
enjoy
this
talk
and
I
have
a
good
rest
of
your
conference.