Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

GitOps Introduction with Argo CD

GitOpsturns deployment upside down. A cunningpull-basedmethod. Tools likeArgo CDautomate app updates by keeping a hawk's eye on Git repos. Toss those convoluted CD pipelines into the trash. If updates stumble—justGit committo roll back. Safe teamwork—no need to touch the cluster... read more  

GitOps Introduction with Argo CD
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Caching is an Abstraction, not an Optimization

Cachingdoes more than rev up performance; it cuts through the chaos of software design, making it tidier and more modular. Sure,LRUandLFUsound like they should open for a prog rock band, but their trusty old formulas stand strong against those wild swings in data access... read more  

Caching is an Abstraction, not an Optimization
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Hewlett Packard Enterprise completes $14B acquisition of Juniper after settlement of DOJ suit

Hewlett Packard Enterprise closed its acquisition of Juniper Networks following the settlement of a lawsuit by the U.S. Department of Justice. This acquisition will allow HPE to expand its networking business and compete in the AI networking market. HPE officials stated that the merger positions the.. read more  

Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Why Kubernetes Throttled My Idle Pods

70% CPU throttlingbaffled me in Kubernetes—minimal CPU usage, yet throttling? Alexandru Lazarev nailed it: ditch the CPU limits. Instant fix. Prometheus paints the spikes, while Grafana smooths them into a bore. Maybe those burstable CPU limits will swoop in to save us soon... read more  

Why Kubernetes Throttled My Idle Pods
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Switching to eBPF One Step at a Time with Calico DNS Inline Policy

Calico Enterprise 3.21rolls out eBPF-driven DNS policies toiptables, slicing latency without needing an eBPF overhaul. EnterDNS inline mode: it outpaces competing DNS policies, kills retransmits, and zips up connections.Nftables?Still lagging in eBPF chops, but xtables—which they’ve put out to pastu.. read more  

Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Cloud Native App Local Development Made Easy with Microcks and Dapr

Dapr's sidecar model makes service talk a breeze.Microcks? It's all about pretending those pesky dependencies are there, so developers can run tests without spinning up an entire Kubernetes circus... read more  

Cloud Native App Local Development Made Easy with Microcks and Dapr
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Kubernetes complexity killer, Lens by Mirantis embedded AI assistant

Mirantis Lens just got a brain transplant. MeetLens Prism, the AI that slices through Kubernetes like a hot knife through butter—offering real-time insights and commands right in your IDE. Wave goodbye to command-line hell with their slickAWS integration. It blitzes through the setup grind, letting .. read more  

Kubernetes complexity killer, Lens by Mirantis embedded AI assistant
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Mirantis Extends Swarm Support Another Five Years

Mirantisthrows a lifeline toSwarm, promising five more years of support. Why? Simplicity. Even as theKubernetesjuggernaut thunders on, over100clients hang tight to Swarm's straightforward charm.MKEcleverly blends these orchestrators, smoothing your path to Kubernetes while cranking up the security d.. read more  

Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Kmesh v1.1.0 Officially Released!

Kmesh v1.1.0shakes things up with an overhauled DNS module. It’s got one job: tackle hostname resolution—no more, no less. BPF configuration? Now effortless, thanks to global variables. As for Kernel-Native mode, it’s less needy. Just a single tweak left inLinux kernel 6.6. Progress... read more  

Kmesh v1.1.0 Officially Released!
Link
@faun shared a link, 10 months, 2 weeks ago
FAUN.dev()

Playbook for building Secure Cloud or Kubernetes Applications

Kubernetes and cloud apps shouldn't toy with security.Least Privilege,Privilege Separation, andZero Trustaren't trendy buzzwords; they're must-have armor. These principles nail down strict controls, carve duties into distinct silos, and demand proof at every turn. What do they transform? They turn u.. read more  

Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.