⚠️ As a side note, we renamed the event name as Kubernetes Community Days Istanbul.

We are living an enjoy of organizing and completing the first ever KCD Turkey, whooo! It was totally such a great experience for all of us because we have organized this event for the first time in Turkey at Istanbul 🚀

We published the event transparency report on CNCF’s official website, if you want to take a look at the reports of the events, please follow the link.

Also, It was a pleasure to meet you all in-person here at Istanbul in first ever Kubernetes Community Days Turkey 🥳🥂 Here is a great photo of ours with Pablo Musa Jona Apelbaum, Cloud Native Computing Foundation (CNCF) Ambassador Emin Alemdar, Halil İbrahim BUGÖL Stéphane Y. and event crew👋

We're thrilled to unveil the official opening of the Call for Papers (CFPs) for Kubernetes Community Days Istanbul 2024! Get ready for the 2nd edition of this incredible event—we can't wait to make it even more phenomenal than before. 🎉

We are more stronger than yesterday because we are now a bigger family! We extended our organizer team with Koray Oksay and Alp Kahvecioglu!

Join us in shaping the future of Kubernetes as we bring together enthusiasts, experts, and innovators in Istanbul. This is your chance to contribute to the vibrant Kubernetes community, share your insights, and be a part of something extraordinary. 🎸

Submit your CFPs and let's make this event bigger and better than ever before. See you in Istanbul! 🌐🚀

➡️ https://sessionize.com/kubernetes-community-days-istanbul/

🏆 GDG DevFest23 Istanbul was amazing!

I and my colleague Furkan Türkal were the speakers of the GDG DevFest23 🎉 It was such a unique experience for both of us to be 🎤 speaking on the stage against 100+ attendees! We talked about the Current State of Art of the Software Supply Chain Security and which services are Google Cloud providing for us to make the software supply chains even more secure that you designed on using Google Cloud services such as Google Cloud Build, GKE, Artifact Registry.

Also, we mentioned several amazing tools you can use today to build 0-CVE container images which means that your dreams now finally came true as I can genuinely say that for being one who knows the challenges of dealing with the vulnerabilities of the software 😰

Here is the link for the presentation if you want to take a look and give us feedback 🫣 ➡️ https://bit.ly/safeguarding-against-supply-chain-attacks

🐳 Let's talk about multi-platform images at Docker Istanbul Community Meetup Group!

Developing Docker images for the Arm architecture can pose challenges, particularly in light of the growing prevalence of Arm-based devices like M1/M2 MacBooks and the increasing popularity of servers such as AWS Graviton. The task of efficiently constructing Arm and multi-platform containers has become a noteworthy hurdle in response to these trends. Consequently, I have decided to present a talk on the intricacies of building multi-platform images using Docker. Furthermore, I'll explore the convenience of automating this process through GitHub Actions, specifically by harnessing Docker's GitHub Actions. This approach promises to streamline the workflow significantly. Additionally, I plan to extend the discussion by demonstrating the creation of a Kubernetes cluster on Google Kubernetes Engine (GKE), incorporating two distinct node pools—one for amd64 and another for arm64 architectures. Finally, we’ll be using Argo CD to deliver our software to Kubernetes clusters. While doing that we’ll be using some techniques in order to assign pods to the nodes.

➡️ https://www.meetup.com/docker-istanbul/events/297734465/

👋 Hello from DevOpsDays24 Istanbul!

I’m thrilled to announce that this year I’ll be the one of the organizers of the DevOpsDays Istanbul event!

Calling all DevOps enthusiasts, experts, and innovators! We're excited to announce the Call for Papers for #DevOpsDaysIstanbul2024. Share your knowledge, experiences, and insights with our vibrant community. Submit your proposals here ↙️

➡️ https://www.papercall.io/devopsdays-istanbul-2023

🔥 Get ready for an amazing DevOps experience! DevOpsDays Istanbul 2024 is coming your way. Tickets are now on sale also, so don't miss your chance to be part of this incredible event.

➡️ https://kommunity.com/devops-turkiye/events/devopsdays-istanbul-2024-45c781c4/tickets

If you are interested in learning more about software supply chain security, most probably most of you have come across the terms in-toto attestations and SLSA provenance. But have you ever ask the question to yourself how these two are related to each other, let’s find out! Thanks to Aditya Sirish and Tom Hennen, they wrote a blog post to explain that.

➡️ in-toto and SLSA

🐙 Day by day, the Wolfi OS package repository is getting bigger!

For people who are not familiar with the Wolfi OS, Wolfi OS is the first Linux (Un)distro designed for securing the software supply chain designed for the container and cloud-native era. Here's Dan Lorenc's quick guide to understanding the unique things that Wolfi OS brings to the table of securing software supply chain security for container images.

We (w/ Furkan Türkal) are constantly adding new packages to Wolfi OS, here are some of them:

• k8sgpt by K8sGPT

• kube-bench by Aqua Security

• paranoia by JetStack

• trust-manager by cert-manager

There are lots of packages still waiting to be added to Wolfi OS which means that all contributions would be very welcomed 🚀

🐳 Docker introduced new best practices guide for container image builders for people of all levels from beginner to advanced, check this out!

Docker created a guide for giving people useful pointers and the best practices for Docker’s build features and this guide definitely should be with you as one of your handbooks when you start building container images for your projects whether you are just getting started or already an advanced Docker user!

➡️ Build with Docker

❌🔑 Keyless Signing support for cosign has been enabled on the staging environment for GitLab CI!

Keyless signing is one of the unique things that the Sigstore community brings to the table and has been used for a long time in the GitHub Actions platform since GitHub announced OIDC support. Now, keyless signing can be used in the GitLab CI as well, thanks to the Sigstore community, this support has been rolled out to staging, please use it and share your feedback with the community!

Also, Carlos Panato already created an example that shows how to use this support on GitLab CI.

➡️ Testing Cosign

💃 SLSA v1.0 was released!

In recent weeks, SLSA v1.0 was released and lots of great resources were created to explain what the new things are in the v1.0 release.

➡️ SLSA v1.0 is now final!

A blog post was published on Google’s security blog:

➡️ Celebrating SLSA v1.0: securing the software supply chain for everyone

Also, Cloudsmith made a live webinar to discuss what’s SLSA 1.0 mean for us:

➡️ SLSA 1.0 is here! What’s it mean for you?

🌟 There is even a tracking issue created to document all the projects that currently support SLSA provenance generation today such as Docker Buildx, Tekton Chains, Sigstore cosign, and many more.

➡️ Tracking issue for draft SLSA 1.0 support in tools

🚨 CNCF is working to improve the software supply chain security for the graduated projects hosted by itself!

CNCF worked in collaboration with Chainguard to assess the software supply chain security practices of two of our graduated projects, Argo and Prometheus based on Supply-chain Levels for Software Artifacts (SLSA), which provides a framework for software supply chain integrity. Here is the blog post that can give you the details:

➡️ Building secure software supply chains in CNCF with SLSA assessments

🕺🏻I’m thrilled to announce that I'm selected to be part of the new @cncfambassadors #CloudNativeAmbassador program in 2023!

I can truly say that this one was more like a dream for me and I can’t believe that it finally came true, YES, I’ve been accepted to the CNCF’s Ambassador Program in 2023 and became the very first ambassador from 🇹🇷. I don’t know how to express my feelings right now but I can say that I’m so happy to be part of that program and all I want to say is that I’ll do my best to be worthy of it.

🐳 Docker Desktop v4.18 was released a while ago which is a release that focuses on improvements in the command line and in Docker Desktop.

In Docker Desktop 4.17, Docker Scout was first introduced, a tool that provides visibility into image vulnerabilities and recommendations for quick remediation. In v4.18, based on the community feedback, there are some improvements included in the Docker Scout:

• Vulnerability Quickview

• Image recommendations directly on the command line

• Improved remediation guidance with BuildKit SBOM utilization

• A preview feature comparing images (imagine using diff but for container images)

A new subcommand named `init` was introduced, a new CLI command that lets you quickly add Docker to your project by automatically creating the required assets: Dockerfiles, Compose files, and .dockerignore.

Here are the great resources from excellent people:

• Introducing Docker Init: Generating Docker Assets for Your Projects by Ajeet Singh Raina

• Let's discover: docker init command by Aurélie Vache

• A YouTube video recorded by Francesco

Refer to the docker init documentation to learn more.

💃SLSA v1.0 RC2 was announced last week which is your last chance to provide feedback before v1.0 will be released!

SLSA specification is a security framework, a checklist of standards and controls to prevent tampering, improve the integrity, and secure packages and infrastructure, and it gets evolved over the years finally, it will be reached its v1.0 release pretty soon. The SLSA Community announced SLSA v1.0 Release Candidate 2 (RC2) following the valuable feedback they received on the first release candidate.

At the same time, Michael Lieberman wrote a blog post about SLSA to help us understand SLSA a bit better: The Breadth and Depth of SLSA

🎊 Draft release support landed on SLSA GitHub Generator by me!

My first PR to SLSA GitHub Generator which is a language-agnostic SLSA provenance generation for GitHub Actions got merged last week which was related to adding draft-release support. While working on the osv-scanner project by Google, I realized that they mark their release as a draft for some reason. In that case, if we set the upload-assets parameter of the Generic SLSA 3 Generator as true, we will see two different releases with the same tag, one is marked as draft the other is marked as latest which indicates a problem that we need to solve.

So, I raised an issue to tell more about the problem I’m facing, and then I noticed that Ian Lewis already created an issue about this and they talked quite a bit about the problem, so, the only thing left is solving the issue. 🧑🏻‍💻

Finally, to complete the work, we need to test it by adding a test workflow to the example-package project, which is a project by the same community to test all the workflows provided by the SLSA Github Generator.

I’ve added a sample workflow to test the draft release support here.

🌟AS A BONUS, If you are willing to become a contributor to the SLSA Generators like Trusted Go, Generic, Container, and Docker-based generators, you should add your e2e tests to the example package, and thanks to Ian Lewis for a detailed explanation of these.

⏰Final chances to apply for Linux Foundation Training (LiFT) Scholarship Program, the deadline is 3️⃣0️⃣ April!

Are you looking for a chance to attend training courses and take certification exams at no cost? This program is right for you. Because this program provides opportunities to up-and-coming Developers and SysAdmins who show promise to help shape the future of Linux and open-source software but do not otherwise have the ability to attend training courses or take certification exams.

Here is the application form, do not forget to APPLY! ⌛️

🎫🤹‍♀️🇹🇷 Kubernetes Community Days Turkey tickets are now open for sale and I joined the Docker Istanbul Meetup Group as an organizer!

We’ll organize the very first KCD Turkey in Istanbul between May 10-12 and as we completed the final CFP review process, I can genuinely say that there were lots of amazing talks, now, this is a perfect time to open tickets for sale and I’m thrilled to announce that tickets are now open for sale 🥳

As you know, I recently shared that I was included in the Docker Captain program. 🥳 Now I am taking the first steps of this process by starting to work as an organizer in the Docker Istanbul Community Group🙋‍♂️

This means that I humbly invite all those who are curious about Docker and of course all container-specific technologies to join this group. 🫶 In a very short time, I am looking forward to greening these places and meeting you with beautiful physical activities 🤩

✍️ The Sigstore Technical Writer Statement of Interest form for participation in Google Season of Docs is now live, the deadline is 21 April, HURRY UP🚀

Google Season of Docs seeks to empower open-source organizations to understand their documentation needs, to create documentation to fill those needs, to measure the effect and impact of their documentation, and, in the spirit of open source, to share what they've learned to help guide other projects. Fortunately, the Sigstore team is part of that program. This is a perfect opportunity to make an improvement in the Sigsstore official documentation while learning lots of amazing stuff about supply chain security and the tools developed by the Sigstore team like Cosign, Rekor, and Fulcio, and hurry, time is ticking! ⌛️

Here is the application form, do not forget to APPLY!

We already know that Docker plays a crucial role in securing software supply chains by providing features such as generating SBOM and SLSA provenance during the build with BuildKit v0.11, and scanning images, etc. Now, there is a new kid in the town `docker scout` that provides visibility into vulnerabilities and recommendations for quick remediation that was announced as one of the newest features released with Docker Desktop v4.17.

There is lots of amazing content about Docker Scout created.

• Here is the first video about Docker Scout recorded by James Spurin 👇

• Bret Fisher detailed Docker Scout in his newsletter!

• And Ajeet Singh Raina wrote a blog post about Docker Scout for the first look!

🚢 I’m officially a Docker Captain now!

I am announcing for the first time that I have been accepted to the Docker Captain Program and I am the first Docker Captain from 🇹🇷! Since Docker is heading towards the software supply chain security space, I thought this might be the perfect opportunity for me to apply for this program because I am also interested in doing something and learning more about software supply chain security and it worked, they accepted me to join this program. I'm very excited about this role, I hope I can be worthy of it! If you are also willing to join the Docker Captain Program, here is the quick “How to Become a Docker Captain” guide by Ajeet Raina who is one of the Docker Captains.

💃 I made my first contribution to the SLSA 3 Go Builder workflow!

SLSA gives you a set of standards you can adopt to improve artifact integrity and gradually build toward completely resilient systems from level one to four. Unfortunately, there were not many ways to generate SLSA provenance for the software until `slsa-github-generator` which is a language-agnostic SLSA provenance generation for GitHub Actions was announced! The team behind this project announced the General Availability of the SLSA 3 Go native builder for GitHub Actions a while ago. While working on the Scorecard project that uses SLSA 3 Go Builder in its release workflow to add a verification step for the provenance, I noticed that we need to apply a workaround to get the provenance name generated and signed by the SLSA 3 Go Builder, so, I created a PR to add it to the outputs of that workflow to make getting the name of the provenance easier!

📦 Adding new packages to package repositories such as Wolfi OS and NixOS is fun!

I’ve been adding new packages to Wolfi OS for a while. It always has been fun to add new packages to package repositories and I highly recommend you do the same as well. Then I met NixOS and realized that packages I might be interested in are available on NixOS too. Here is a weekly summary of my participation in NixOS:

1️⃣ One of the first packages that I got involved with is cosign. I'm one of the contributors to the project for a while. Now, I'm one of the maintainers of that project in NixOS!

$ nix-env -iA nixpkgs.cosign

2️⃣ The second project is Rekor which is one of the other successful projects maintained by the Sigstore. `rekor-cli` is a client CLI of the Rekor server. Now, I'm one o the maintainers of that project in NixOS!

$ nix-env -iA nixpkgs.rekor

3⃣ Third package is gitsign. gitsign allows you to sign your commit messages by using Sigstore public-good services with a keyless approach. Now, I'm one o the maintainers of that project in NixOS!

$ nix-env -iA nixpkgs.gitsign

and many more!

The experience I gain through the contributions I tried to bring in new packages into NixOS and I've added bom and slsa-verifier packages into NixOS!

🎤 Lots of amazing events have been announced during the week related to software supply chain security!

There will be another event you don't wanna miss from Chainguard: Come to SLSA with us!💃Look at these amazing speakers, each of them has played a crucial role in the SSCS ecosystem! This will be a great opportunity to listen to #SLSA from them.

There are only 5⃣ days left to one of my favorite⚡️Enlightning Talks⚡️ by Whitney Lee about Sigstore with Zack Newman and Lewis Denham-Parry.

If you haven't set your reminder, do not forget to do it now, you can thank me later☝️😅

I can truly say that there will be an amazing talk by Adolfo García Veytia and Patrick Flynn about #SBOM, #SLSA, #WolfiOS, and Sigstore OH MY waiting for you folx if you are lucky enough to be in Montreal, I highly recommend you to go to this event, I wish I could be there 😓

🔑❌ One of the unique things that Sigstore brings to the table is Keyless Signing!

There are several critical things you can benefit from keyless signing. First of all, it reduces the risks of compromise in the first place by eliminating the hassle of long-lived key management. Kaylin Trychon from Chainguard wrote a blog post that details the benefits of keyless signing:

TLDR;

• 🔐 Improved security: reduces the risk of key compromise

• 🐾 Enhanced traceability: an auditable record of the software signing process

•‍🤸 Increased flexibility: keys do not need to be present on the signing machine

•‍👯 Reduced reliance: multiple people can be authorized to sign

🙉 A new article just published on Google’s open-source blog about achieving SLSA Level 2 with Tekton and Tekton Chains!

Tekton chains is a supply chain manager for Tekton, basically, it is a standalone system that observes Pipelines and generates provenance for the artifacts built by Pipelines. I wrote a blog post about Tekton Chains in detail if you want to dig into this technology.

🎖 My badge collection is getting bigger and bigger day by day!

I was one of the committee members of the GitOpsCon + cdCon program this year! It was a very fun process to review all these amazing CFPs. I learned so many things from the other committee members during the discussion meetings. Again, I’d like to thank them all for having me.

That’s all for me today, I hope you enjoyed reading, and please do not forget to subscribe if you want to keep in touch with the recent newsletters, thanks in advance, and see you in the next issue! 🙉

We, with Furkan Türkal, attended the first-ever KCD Pakistan! It was a unique experience for us to be part of one of the Kubernetes Community Days events. So you can reach out to our talk about creating a secure base image with apko using Wolfi OS packages and using it with ko to build OCI-compliant container images, signing them cosign in keyless mode, and verifying them with Kyverno!

🌟 Become a CDF Ambassador in 2023!

A while ago CD Foundation team published a new blog post to announce that the CDF Ambassador Program is now officially open!

Becoming a CDF Ambassador was one of my goals in 2023! So, I'm super excited to announce that I've applied for it, my fingers crossed 🤞

Do not forget to send your applications if you are willing to become one 🙉

💀 Deadline is 28 February, so hurry up; 7 days left!

📦 OCI v1.1 (Referrers API)

Referrers API is one of the newest changes merged to the upstream OCI repository constructed by the OCI Reference Types WG. This API's primary goal is facilitating the map of the software supply chain artifacts such signatures, attestations, and SBOMs with OCI images because there are different ways of doing that today; for example, cosign uses container image tags to store and associate them with the images, on the other hand, BuildKit uses layers to store them and uses annotations to define their types. Undoubtedly, there should be a standard for providing this type of mapping between the two, and this is where Referrers API comes in handy.

Let’s be ready for the future of the OCI 🙉

• Start with learning what these Reference Types are with the blog post written by Josh Dolitsky

• Brandon Mitchell will become one of your good friends if you want to learn more about Referrers API, here is an excellent presentation made by him:

• Another incredible talk was presented at KubeCon 22 NA by Josh Dolitsky & Sajay Antony about how they solved a complex problem of determining how to describe and query relationships between objects stored in an OCI registry. You can find the demo of the talk here on GitHub.

• Finally, OCI v1.11 support came to the cosign, and the Sigstore team has achieved a significant milestone!

🐳 New blog posts about the newest BuildKit features are continuing!

Undoubtedly, BuildKit v0.11 is one of the utmost releases in history because it includes many supply chain security features, such as generating both SLSA provenance and Software Bill Of Materials, SBOM for short.

Here is a quick takeaway from Felipe Cruz 🏃‍♂️💨

➡️ First impressions and learnings on the new BuildKit's supply chain security features

To better understand Docker’s vision of Software Supply Chain Security, you should read the article from Justin Cormack about the best practices of software supply chain security published on the Docker Blog 🧵

➡️ Secure Software Supply Chain Best Practices

📢🥁CNCF announced the new Kubernetes and Cloud Security Associate (KCSA) certification in Q3 2023!

What excellent news for Kubernetes security enthusiasts 🥳

I'm very excited about this new certification exam KCSA because one of today's most critical types of attacks is a software supply chain attack; hopefully, there will be many related questions.

I've already signed up for the KCSA Beta Tester program because this is a perfect opportunity to collaborate with other security folx to design the program's future. Thanks to the Linux Foundation and Chris Aniszczyk for creating such an excellent exam to help the community increase awareness about Kubernetes and Cloud Native Security.

🎊 SLSA 3 Container Generator for GitHub Actions is now GA

SLSA 3 Container Generator for GitHub Actions is also GA after the Generic Generator. You can use them to generate provenances for your containers in CI running on GitHub Actions.

📢🥁Registration for #ContainerPlumbing is now open!

Check out the schedule, and do not forget to register on March 23. ☝️

#ebpf #oci #immutable #containerruntimes #wasm #wasi #nerdctl #referrersapi

➡️ https://containerplumbing.org/schedule

📢🥁A new blog post about ko!

A new blog post about #ko, which is a fast container image builder for #golang applications, just dropped into the line, thanks to theVladimir Vivien🕺🏻

➡️ Build and Publish Lightweight Go Binaries into Container Images with ko

🙉This announcement above was one of the utmost unforgettable moments in my life

🎉 Yep, you heard right, we are organizing the Kubernetes Community Days in Turkey for the first time on 11-12-13 March 2023 in Istanbul, and I’m so glad to be part of that event by being one of the organizers of it. I’m super excited to meet all of you in person.

🔥 An important update, CFP is still open until Jan 31, and please be hurry to send CFPs to take your seat in that organization as speakers. 🔥

➡️ To send a CFP: https://kcd.smapply.io/prog/kcd_turkey_2023/

📰 My blog post about OCI Image Layout is on the news once again

I'm so grateful to the KubeWeekly community for supporting my articles by giving them a spot in their newsletter series. I wrote an article about OCI Image Layout on the Continuous Delivery Foundation website, which was featured in the #332 issue of the newsletter.🥳

➡️ https://email.linuxfoundation.org/kubeweekly-332

🐳 The Best Docker BuildKit & Buildx Release so far, in my opinion!

The Docker community is one of the communities that take software supply chain security risks seriously. Accordingly, they try to add features to products both Docker Desktop, Docker CLI, and BuildKit to mitigate the risks of the software supply chain attacks, such as generating SBOMs, displaying the vulnerability information, providing SLSA provenance based on build information, etc.

The BuildKit (v0.11) release came with amazing features such as SLSA Provenance, OCI Image Layout&annotations, #SBOM, and reproducible builds through SOURCE_DATE_EPOCH build arg. All are explained in a very well format in this blog post, thanks to Justin Chadwell.

➡️ Highlights from the BuildKit v0.11 Release

🎖 I’m one of the members of the Software Supply Chain Security SIG of Continuos Delivery Foundation from now on!

All my dreams come true one by one🙈 I'm so glad to announce that I'm one of the members of the Software Supply Chain Security SIG of Continuos Delivery Foundation from now on🎉

On the other hand, I’m aware of the importance of this role, so I will try to be as active as possible in the community to be worthy of this role!

By the way, I'm not ashamed to say that I'm not an expert on SSCS, but it doesn't mean I can't help🤞

➡️ https://github.com/cdfoundation/sig-software-supply-chain/pull/29

😰 "Barely 1% of all SBOMs being generated today meets the “minimum elements” defined by the U.S. government."

The quote we mentioned in the header of this section was from the blog post by Ryan Naraine published on the SecurityWeekly website, and this is quite a big problem that we all need to be worried about. Thanks to the folx at Chainguard, they organized an event to raise awareness about the quality of the SBOMs we generate or even we already use. A great talk was recorded about measuring the #SBOM quality in Chainguard’s Software Supply Chain Security Leadership Series by the amazing folx Justin Abrahams, John Speed Meyers, and Tracy Miranda.

➡️ To watch the recording on demand: Software Supply Chain Security Leadership Series: Measuring SBOM Quality
➡️ To read the blog post: Are SBOMs Any Good? Preliminary Measurement of the Quality of Open Source Project SBOMs

🦅 Falco Software Security Supply Chain Working Group

I’m so glad to see that the Falco community created a Software Supply Chain Working Group to work on mitigating the risks of the software supply chain attacks by providing assurance on the artifacts they produce and making them more transparent to the consumers to keep them aware of the risks of their artifact associated with. Thanks to Luca Guerra for creating this working group, and I’m also super excited about being part of that WG 🎊

Here are the details of the WG:

• Slack channel: https://cloud-native.slack.com/messages/falco-sscs-wg

• HackMD: https://hackmd.io/FwSPVkdHT0i8T4Q8JdfOaw

• Join the call: https://zoom.us/my/cncffalcoproject

👀 SPIFFE, Sigstore, and Kyverno are the projects that we should keep our eye on in 2023!

A blog post was published a while ago by Kirsten Newcomer on DarkReading based on predictions about Kubernetes-related security projects to watch in 2023. I'm so glad to see all the projects I got involved in are on the list: SPIFFE, Sigstore, and Kyverno. 🥳

➡️ Kubernetes-Related Security Projects to Watch in 2023

📢 GoReleaser enthusiastically supports the ko project in 1.15!

If someone could ask me if you were alone on the island of software, what would be the projects you would take with you? My answer would probably be GoReleaser, ko, and, of course, cosign. 🙈

Starting with GoReleaser 1.15, I’m happy to announce that you can build your container images with ko by setting its configuration options.

Big thanks to Carlos Becker and Jason Hall, who helped to make my dream come true🫶

➡️ Here is a quick guide that can help you to experiment with ko support: Docker Images with Ko

🇨🇳 My Blog Post about Becoming the Next Best Sigstore Evangelist was Translated into Chinese and shared by OpenSSF China

I wrote an article about my journey of winning the “Best Sigstore Evangelist” to encourage people to become the next best sigstore evangelist. It was published on the Sigstore blog recently. A while ago, Feynman Zhao, one of my friends, reached out to me from Twitter DM and said, “Your blog post has been translated into Chinese and retweeted by OpenSSF China,” and that was another OMG kind of moment in my life 🙈

🤞I applied for KubeCon+CloudNativeCon Europe 2023 Scholarship

A while ago, CNCF announced an important update about the scholarship for the KubeCon + CloudNativeCon Europe. If you ask what the importance of these scholarships is, they give you a chance to attend KubeCon if you still need to attend them. So, please apply for these kinds of scholarships to keep your dream alive 🔥

🎖OCI Image Layout: No more Additional Network Requests

I wrote a blog post about the OCI Image Layout, impressed by the talk by Brandon Mitchell, and it was published on the Continuous Delivery Foundation blog a while ago. The CDF told me it got over 1K hits on LinkedIn, which is awesome, so I’m so glad to them for helping me to create such an impact 🥳

🔖 Sigstore December Roundup mentioned my blog post

Sigstore always publishes monthly roundups, which is one of the utmost critical ways of keeping yourself notified about the recent updates all along with the Sigstore community in one of the roundups, specifically the December Roundup; thanks to the Sigstore, they mentioned my blog post in the “New Content” section, but this is not the only section within the roundup, you will find lots of notable updates in different categories related with the community 📣

📈 OpenSSF community shared two important reports

The OpenSSF community shared two important reports recently: “2022 In Year Review” and “2022 Annual Report”. These kinds of reports are essential for us to see all the efforts made so far from a single point. You should go and check out the highlights of the year 2022 on behalf of the OpenSSF community; thanks to Chainguard, they wrote another blog post to summarize all these highlights from their point of view. 🖼

🎖SPIFFE is using Chainguard’s wait-for-it image officially

The wait-for-it project is one of the most actively used projects in the SPIFFE ecosystem. One day, we found an issue created by Eli Nesterov complaining about the vulnerability count of the wait-for-it image built from here and used in the spire-tutorials project. At that time, we saw an opportunity to use Apko + Melange tools to create a CVEless version of it and ship it with Chainguard images. According to that, we built a new version of the wait-for-it image, and it’s now available for everyone at the registry URL cgr.dev/chainguard/wait-for-it. And the PR we created to promote using Chainguard’s version of the wait-for-it image is now merged, which means that SPIFFE is using this in official projects. 🥳

🐳 Another Career Opportunity by Docker You Don’t Wanna Miss

Nuno Coração, who is working for Docker as Product, shared a Tweet about Career Openings at Docker and if you are interested in joining Docker, please follow this tweet below🤞

💡 A great idea about the ko project related to the SBOM and Rekor

Recently, Eric Smalling talked about the different ways of building OCI images without requiring any Dockerfiles or a running docker daemon in one of the events of DevOpsDaysDFW. In one of the sections of his presentation, he mentions the ko project, a very new CNCF sandbox project created by two amazing people, Jason Hall and Matt Moore, that simplifies building container images and securely. But there was a small mistake in Eric’s presentation about ko. He used the following picture and said, “ko signs the generated SBOM and uploads it to the Rekor” this is not right at the moment I’m writing this. Still, on the other hand, this is a brilliant idea; at least, this is something we must discuss on it, so come and join to #ko-build channel on Kubernetes slack to share your opinions about it.

🎊 Welcome to the newest Continuous Delivery Foundation’s SSC SIG co-chair

There has been an ongoing election for a new co-chair of the Continuous Delivery Foundation (CDF) Software Supply Chain SIG, which is finally ended. Congratulations to David Bendory; he has been elected as the new SIG co-chair. 👏

🥳 We are now 400+ in Software Supply Chain Security Twitter Community

A while ago, Josh Long joined our community and became the 400th member of the community, and I'm so glad to see him as part of our community.  Please do not forget to join if you haven’t joined yet, and this is where You will find many great blogs, news, videos, etc., related to software supply chain security.

🎖 Official Docker Twitter Account followed me back

Yesterday was one of the most unforgettable days in my life because the official Docker account has just followed me back 🥳

🗞 I've applied to KubeWeekly Editor program

KubeWeekly newsletter is one of the most essential newsletters that can help you to keep yourself up to date with the recent changes in the CNCF ecosystem. Now, they are looking for talented editors. Are you interested in helping to curate the weekly newsletter? If so, here is the application form link below 👇

🤞 I'll try my chance to be part of the Kubernetes v1.27 Release Team Shadow

As I shared in one of my previous newsletter issues, The shadow application for the Kubernetes 1.27 release team is now open! The form will remain open until Tuesday, 3rd January 2023, do not forget to apply while you still have a chance.

Career Openings

🐳 Docker is looking for Sr. Product Manager (Supply Chain)

We all know that Software Supply Chain Security is one of the utmost critical problems threatening today's software industry. Docker is looking for Sr. Product Managers eager to develop products to protect the ecosystem against these threats.

Docker is a remote first company with employees across Europe and the Americas. Check out our latest career openings and apply today!

⏰ Security Engineering Internship by Google application will be open soon!

Google is looking for Security Engineering Interns, and this is an excellent chance to learn lots of fantastic software security-related stuff; do not forget to apply it.

Apply for Security Engineer Intern, 2023 via Google Careers. Read about the role and find out if it's right for you.

💖 Are you interested in working in a Software Supply Chain Security Company?

Chainguard is a company that aims to make the software supply chain secure by default. If you are eager to work as close to the software supply chain industry as possible, please do not forget to look at the open roles.

Important Announcements

🔖 We are going to organize our first in-person event as Cloud Native Türkiye & Kubernetes

I wrote an article about OCI Image Layout, published on the Continuous Delivery Foundation official blog; thanks to Roxanne Joncas and Fatih Değirmenci for supporting me. It is time to talk about that in public at the in-person event. (in Turkish)

CNCF Istanbul presents Docker'sız bir dünya hayal mi gerçek mi? | Dec 29, 2022. Find event and ticket information.

🌱 Linux Foundation's Dan Kohn Scholarship Fund to be able to attend KubeCon Europe 2023

Want to attend KubeCon EU 2023? Thanks to the @linuxfoundation's Dan Kohn Scholarship Fund, you can still achieve your goal of attending @KubeCon Europe 2023. The Dan Kohn Scholarship Fund exists to support individuals who may not otherwise have the opportunity to attend in four categories. The scholarship applications are now open and apply before 19th February.

The Dan Kohn Scholarship Fund exists to support individuals who may not otherwise have the opportunity to attend in four categories: Applicants must be from…

📣 The schedule for CloudNativeSecurityCon North America 2023 schedule is announced!

The CloudNativeSecurityCon schedule is out and was announced a week ago. What a fantastic program, do not forget to check it out! I've also applied for that, but unfortunately, I got rejected; of course, I'll never give up and keep going to try for upcoming events🙈

View the KubeCon + CloudNativeCon Europe 2020 Schedule & Directory.

I am grateful to @theopenssf and Tracy Miranda for mentioning my award in one of the blog posts posted on their official website. You can find all the other highlights about the SigstoreCon in the blog post here.

🎧 Live Recording by me about Securing Base Images

We (w/@cloudnativeboy) made a recording in @CloudIslamabad about securing base images through signing with @projectsigstore and policy enforcement at runtime with @kyverno based on a blog post on the @NirmataCloud website 🥳 My first talk in English, so please bear with me🙈

https://www.youtube.com/watch?v=T9pXLmb61Vw

Here is the blog post that I mentioned above 👇

https://nirmata.com/securing_base_images/

📦 wait-for-it OCI Container Image

I'm super excited to announce that the wait-for-it OCI container image with zero CVE is landed on @chainguard_de images by me 🥳 The @SPIFFEiocommunity is about to use it in their tutorials 🤝 You can find more details about that image 👇

https://github.com/chainguard-images/images/tree/main/images/wait-for-it

🐦 Software Supply Chain Security Twitter Community

I created for Software Supply Chain Security Twitter Community to spread knowledge about the SSCS, which has been one of the hottest topics for almost two years. You will find many great blogs, news, videos, etc., there. Please do not forget to join if you haven't joined yet. 👋

https://twitter.com/i/communities/1590611905651040256

🔔 Important Announcements

⛵️ Kubernetes is starting to sign release artifacts

Starting from v1.26, the @kubernetes is starting to sign release artifacts, in addition to the container images, of course, using the @projectsigstore cosign tool. Don't forget to read this blog post to learn more about the process 👇 Thanks to Sascha Grunert for writing this 💖

https://kubernetes.io/blog/2022/12/12/kubernetes-release-artifact-signing/

🎤 Google's Kubernetes Podcast

Google's Kubernetes podcast about other amazing features of v1.26 is out 🎉

https://kubernetespodcast.com/episode/195-kubernetes-1.26/

📝 The Shadow Application for Kubernetes 1.27 Release Team is now open!

The shadow application for the @kubernetesio 1.27 Release Team is now open! Thanks to @JamesLaverack for letting us know about that 👋 The only thing you have to do is fill out the application form to be considered as a shadow on the team. 👇

https://docs.google.com/forms/d/e/1FAIpQLSdpZy9HA7T2RQaVZGGQ759LN_OV6fvRQDYA_hekOD1GdZptPw/viewform

Further details on the 1.27 Release Team can be found in the following issue 👇

https://github.com/kubernetes/sig-release/issues/2107

📣 Lots of notable announcements by the Continuous Delivery Foundation

Lots of notable announcements are happening by the @CDeliveryFdn, and trust me, you don't want to miss ☝️

The @CDeliveryFdn Software Supply Chain SIG is now opening elections for a new co-chair! You only have to express interest in becoming the new co-chair under this GitHub issue🚨. Thanks so much, @fdegir, for letting me know about this 💖

https://github.com/cdfoundation/sig-software-supply-chain/issues/26

There will be cdCon + GitOpsCon co-located with the OpenSourceSummit NA organized by @CDeliveryFdn on May 10-12. They are looking for program committees for the cdCon 2023, and you should not miss that chance to earn a new badge 😇 Thanks so much, @roxannejoncas, for letting me know about this 💖

https://docs.google.com/forms/d/e/1FAIpQLScIaJuE765m-d3CewR0axt94ywffQbh-P81zkJCrA-5K1tcfA/viewform

✨ CNCF Ambassador is now accepting applications for spring 2023

Another big news from @CloudNativeFdn. 🥳 They announced their long-awaited ambassador 2.0 program is now accepting applications for spring 2023. Visit https://www.cncf.io/people/ambassadors/ to learn more about the program and requirements. Applications close February 26, 2023. 🚨🗓

👀 KubeDay Japan videos were uploaded

KubeDay Japan videos were uploaded and available as a playlist on the @CloudNativeFdn YouTube channel, go and check it out; amazing talks are waiting for you to watch 👋

https://www.youtube.com/playlist?list=PLj6h78yzYM2Paf46ZWrXTqK9NHWjtMxhc

🔖 Important update from OpenGitOps.dev

First off, GitOpsCon has been moved by the CNCF to OpenSource Summit, which means that GitOpsCon is turned into a bigger event!

https://opengitops.dev/blog/cdcon+gitopscon-at-open-source-summit/

This first issue is going to be a quick one about introducing myself and the things to be in this newsletter series 👋

Let me introduce myself first. My real name is Batuhan Apaydın, but if you know me as a developer-guy, that's ok 🙈 because I've used this name for my social accounts such as GitHub, Twitter, etc. I started my career as a Java Backend Engineer. Still, my interest always has been working as closely as possible with Go, containers, Kubernetes, and other Cloud-native technologies because if there is something that I like most is working with the most recent technologies, this is why I call myself technology enthusiastic. I'm also an organizer of the two most popular organizations in Turkey: DevOpsTr and Cloud Native Türkiye & Kubernetes.

In addition to my career, I started contributing to the open-source one year ago, which changed my life. Working with open source helped make my work more visible to the community. I mainly contributed to several official CNCF projects, such as Flux, Kyverno, ko, Falco, etc., by writing code, sometimes improving the documentation, and sometimes writing a good blog post. But, for this one year, on the other hand, my interest was very much in software supply chain security; this is why I started contributing to the Sigstore tools, especially cosign. I noticed that people who might want to learn more about the updates in the software supply chain security space need help because so many things are happening simultaneously.

Accordingly, I helped many organizations' projects to make them aware of the risks associated with the SSCS and integrated them with Sigstore tools to mitigate them; this is why the Sigstore community gave me the "Best Sigstore Evangelist" award in the SigstoreCon happened this year:

https://twitter.com/projectsigstore/status/1585005073519636481

Also, for people who might not be aware of the community, I created for Software Supply Chain Security to share the knowledge around the SSCS, which is the hottest topic. You will find many great blogs, news, videos, etc., there. Please do not forget to join if you haven't joined yet 💫

https://twitter.com/i/communities/1590611905651040256

I plan to make these newsletters mostly related to software supply chain security. Still, of course, there will be lots of other great stuff related to the containers, other newsletters that I found helpful, Kubernetes, Cloud-native, etc. Also, because I got involved in so many communities during my career journey, I can benefit from that to make you aware of all the recent updates on the topics I mentioned.

To keep in touch, you can reach out to me from the following accounts:

• Twitter: @developerguyba

• Mastodon: @developerguy@hachyderm.io

• GitHub: developer-guy

• LinkedIn: https://www.linkedin.com/in/bthnapydin/

That's all for today, and please do not forget to subscribe to say tuned with the upcoming newsletters! 🙋🏻‍♂️