Cloud Native
Security Talks RSS

KubeCon North America 2021

We Built the Kubernetes SBOM and Now You Can Write Your Own!

Adolfo García Veytia, uServers

Abstract

At the end of 2020, SIG Release set a goal to produce a Software Bill of Materials for Kubernetes to provide the community and downstream consumers with a verifiable manifest to attest the completeness and consistency of the artifacts built and published with each release. Adolfo will tell how the Release Engineering team built the Kubernetes SBOM and how this effort resulted in a set of libraries and tools which can be leveraged by software developers and other projects to create their own SPDX-compliant Bill of Materials out of files and container images with automatic license detection. He will address the role an SBOM plays in the software supply chain puzzle, enumerating its benefits for developers and operators. He will do a review of the SPDX standard (Software Package Data Exchange) and the rich relationships between software components it can express. The session will feature a live demo of building an SPDX SBOM using said tools which are already available to download.

More from KubeCon North America 2021

Open in the index →
  1. sigstore: How We Started, Where We Are, Where We are HeadedBob Callaway, Red Hat & Dan Lorenc, Google 2021-10-13
  2. My Container Image has 500 Vulnerabilities, Now What?Matt Jarvis, Snyk 2021-10-13
  3. Kubernetes Supply Chain Security: The Software FactoryAndrew Martin, Control Plane 2021-10-13
  4. Kubernetes Exposed! Seven of Nine Hidden Secrets That Will Give You PauseIan Coldwater, Twilio & Brad Geesaman, Aqua Security 2021-10-13
  5. Exploiting a Slightly Peculiar Volume Configuration with SIG-HonkIan Coldwater, Twilio; Brad Geesaman & Rory McCune, Aqua Security; Duffie Cooley, Isovalent 2021-10-13
  6. Untangling the Multi-Cloud Identity and Access Problem With SPIFFE TornjakBrandon Lum & Mariusz Sabath, IBM 2021-10-14
  7. Know Your Enemy: Mapping Security Risks Using Threat Matrix for KubernetesYossi Weizman & Ram Pliskin, Microsoft 2021-10-14
  8. Keeping Up with the CVEs: How to Find a Needle in a Haystack?Pushkar Joglekar, VMware 2021-10-14
  9. Insights into Unsecured Kubernetes in the WildJay Chen & Aviv Sasson, Palo Alto Networks 2021-10-14
  10. Fine-Grained User Authorization for Kubernetes with OPA and LDAPCagri Cetin & Quentin Long, Yelp Inc. 2021-10-14
  11. The Hitchhiker's Guide to Kubernetes VulnerabilitiesRobert Clark & Micah Hausler, Amazon 2021-10-15
  12. Everything Wrong with K8s Authentication and How We Worked Around ItMo Khan & Margo Crawford, VMware 2021-10-15
  13. Bridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster AuthenticationAndrew Harding, VMware 2021-10-15