OSS + ELC EU 2026

Container image signing, SBOMs, SLSA attestations.... five years ago, the Kubernetes project was a trailblazer securing its releases using these and other security features. Having developed its own tools and solutions, things "just worked" for the project, but security technologies evolve and so have we.

Join us as as we dig deep to explore and compare the metadata the project started producing in 2021 with how modern supply chain tools expect them today.

During this talk, we'll do an overview of the updates and modernization of the Kubernetes secure build process and tools. We will examine visually the quality improvements to the Kubernetes SBOMs, how we migrated the SLSA provenance we use to gate our releases to SLSA v1, signing into Sigstore bundles, and, most importantly, how the the toolchain built by K8s Release Engineering enables more than a hundred independently managed projects under the Kubernetes umbrella to build and ship security features to protect themselves and their users.

Out tooling is available for anyone so perhaps we can inspire you to to the same for your projects!