Pooja Bolla·2d agoSoftware Supply Chain Security on Kubernetes, Part 1: Signing Container Images with CosignHow I sign and verify container images with Cosign v3, so I can prove the image running in the cluster is the one our pipeline built.
InITNEXTbyMohammad-Ali A'RÂBI·Oct 13How to Secure Java Docker Images and Reduce CVE RiskSBOMs, CVEs, Docker Hardened Images, VEX, and Cosign
HIDOURI Bellkis·Oct 5Supply-Chain — Container Image Signing on AKS with Cosign and KyvernoWhy sign images at all
Kaif Mohammed Khan·Aug 29Shift Left Is Dead. Long Live the Verifiable Software Supply Chain.How I upgraded a standard DevSecOps CI/CD pipeline into an unforgeable, cryptographically signed release engine using GPG, Gitleaks…
InAWS TipbyKennyAngJY·Aug 27Securing the Container Supply Chain: Cosign Image Signing in AWS ECR with Kyverno EnforcementContainer images are often treated as trusted simply because they come from a private registry or a well-known public registry. In reality…
Kasiramkompella·Jun 23Signing Container Images with CosignWhen you pull a container image from a registry, how do you know it actually came from a trusted source? How do you know no one tampered…
Pras' Labs: The Hands-On Engineer·Apr 23CI/CD Lab 07: Artifact Signing and SLSA Provenance in GitLab CIThe security gate passed. The image is in the registry. But can you prove it?
InInfoSec Write-upsbyPeace Dennis·Apr 3Container Image Security (Signing and Scanning with tools like Cosign, Trivy)I hope you are enjoying the Kubernetes security posts that I am currently sharing. They have honestly been interesting so far. In my last…
Hansaka Biyon·Jan 30Enforcing Signed Container Images in Kubernetes Using Cosign & Kyverno (Helm-based Setup)Securing the container supply chain has become a baseline requirement for production Kubernetes clusters. As clusters grow and multiple…
