How Tekton, Cosign, and Kyverno Create a Fully Signed Kubernetes CI/CD Pipeline

·8 views

A homelab engineer has documented a four-component CI/CD security stack built on RKE2 Kubernetes, ensuring every container image is built, scanned, signed, and verified before deployment. The pipeline uses Tekton for in-cluster image builds, SonarQube and Trivy for code quality and vulnerability scanning, and Tekton Chains to attach cryptographic signatures and SLSA provenance to each artifact. Images are stored in a self-hosted Harbor registry alongside their signatures, provenance data, and software bill of materials. Kyverno acts as the admission gatekeeper, rejecting any image at the cluster door that does not carry a valid cryptographic signature. The setup replaces Jenkins and Nexus with cloud-native alternatives, reducing complexity while enforcing an end-to-end verifiable software supply chain.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Power BI Performance Issues Often Stem From Poor Data Modelling, Not DAX

Most Power BI problems — including incorrect totals, unresponsive slicers, and slow reports — are typically rooted in flawed data models rather than faulty DAX calculations. Data modelling in Power BI involves organizing tables and defining relationships between them to enable accurate and efficient analysis. Three common modelling approaches exist: flat tables, which store all data in one place and suit small datasets; star schemas, which connect a central fact table to surrounding dimension tables; and additional structures suited for more complex needs. A well-designed model improves reporting accuracy, dashboard performance, and the reliability of calculated metrics. It also makes reports easier to maintain and scale as data volumes grow over time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer shares four-role AI model routing system to match task risk with compute

A software developer has outlined a structured approach to AI-assisted coding that assigns every task one of four roles — Navigator, Builder, Diagnostician, or Surgeon — based on the reversibility and complexity of potential mistakes rather than project importance. The framework routes work across multiple AI tools including Claude Code, Codex, and Cursor, using models like Opus 5.5, Grok, Fable, and Sonnet at varying effort levels depending on the role. For tight, signal-clear execution loops, Grok in fast mode is favored for speed, while high-stakes irreversible tasks such as auth flows and database migrations are handled by Fable or Opus 5.5 at maximum effort. The author notes that fast executors tend to fix symptoms within a single layer, so any multi-layer work must pass a slower verification step before being considered complete. Anthropic released Opus 5.5 this week at a reduced price, with reported performance comparable to Fable, making the fallback option more cost-effective for teams using this routing method.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Proposes Open Standard for AI Agent Identity Lifecycle Semantics

A developer has published a position piece on DEV Community arguing that open standards for AI agent identity must go beyond token formats and API shapes to address lifecycle semantics. The author contends that critical questions — such as how agents are created, what pre-ownership states mean, and how delegation and provenance are tracked — remain unresolved in current approaches. They introduce SAL (available at sal-protocol.dev) as an attempt to define this lifecycle layer, with Vibebase serving as its reference implementation. The piece warns that standardizing too low in the technical stack risks entrenching compatibility around the wrong abstractions, especially as autonomous agents present concerns that traditional user and service authentication models were never designed to handle. The author invites community pushback on what should be in or out of scope for any emerging agent identity standard.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Engineers Build a Production-Ready Multi-Agent Banking AI on Google Cloud

A major retail bank handling 400,000 monthly support calls set out to reduce telephony costs by replacing routine customer interactions with an AI-powered banking assistant. Engineers began with a simple LLM-backed chatbot but quickly encountered tool overload when connecting it to 20–35 internal banking APIs, causing unreliable tool selection and high latency. To address this, the system was redesigned as a multi-agent architecture using Google Cloud's Vertex AI Agent Engine, with specialized sub-agents handling accounts, transactions, and service requests under a central orchestration layer. The Model Context Protocol (MCP) was introduced to decouple the agent's reasoning logic from direct API integrations, improving modularity and maintainability. The final production design also incorporates zero-trust authentication, PII masking, and full observability across Google Cloud Platform to meet enterprise security and compliance standards.

0 comments Read more at DEV Community