Protect the Pipe - A Policy-based Approach for Securing CI/CD Pipelines

Explore a cloud-native security framework for Tekton pipelines using in-toto, Kyverno, and sigstore in this conference talk. Learn about the unique security challenges faced by CI/CD pipelines and discover how to implement policy-based controls for pipeline composition, configurations, and execution. Gain insights into protecting critical assets in modern applications that are composed of numerous packages and delivered through automated CI/CD pipelines. Watch as the speakers demonstrate the use of open-source tools to attest and verify each pipeline resource and execution step using declarative policies, addressing the growing risks of attacks, vulnerabilities, and misconfigurations in rapid delivery environments.

Protect the Pipe! A Policy-based Approach for Securing CI/CD Pipe... Shripad Nadgowda & Jim Bugwadia