The document discusses the significance of Software Bill of Materials (SBOMs) in enhancing software security and transparency, presented by experts from Anchore and Weaveworks. It highlights GitOps as a methodology for application development and operations that adds business value. Upcoming events related to GitOps and the Cloud Native Computing Foundation's (CNCF) projects are also mentioned, along with the achievements of the Flux project within the CNCF.

1. 1
March 24, 2022
Security: The Value of SBOMs
Dan Luhring, OSS Engineering Mgr, Anchore
Brady Todhunter, Lead DevOps Eng, Anchore
Priyanka “Pinky” Ravi, DX Engineer, Weaveworks
Stacey Potter, Community Manager, Weaveworks

2. 2
Weaveworks is founded on open source
● Flux & Flagger (CNCF): GitOps and Progressive Delivery for k8s
● Cortex (CNCF): Distributed, Long-term-storage TSDB compatible with
Prometheus
● Weave Ignite: VMs with container UX & built-in GitOps management
● EKSctl: Create an Amazon EKS cluster with one command
● (and many many more projects!)
And now … Weave GitOps!
weave.works

3. 3
Speakers Help/Support
Dan Luhring
OSS Engineering Mgr
Anchore
Brady Todhunter
Lead DevOps Eng.
Anchore
Priyanka Ravi
DX Engineer
Weaveworks
Stacey Potter
Community Manager
Weaveworks
Browser
Safari copy/paste
shortcuts may not work
Using Zoom
Questions?
• Use chat (button: top
left corner of screen)
• Escape to exit full
screen
• “To Everyone” or “To
all panelists and
attendees”
Support:
https://support.zoom.us/hc/
en-us/articles/206175806-T
op-Questions
Troubleshooting
Use chat
If the issue is not easily resolved,
we ask that you follow along as
we demo the sample app.
Security: The Value of SBOMs Duration
30-60 Minutes

4. 4
● GitOps is an app dev and operations methodology
● GitOps is a methodology, not a specific tool or
technology.
● GitOps applies to everything
and brings business value.
What is GitOps?...and why do I want it?

5. 5
Source: opengitops.dev

6. 6
👋 Get Connected 💬 🤝
● ⭐ Star us on GitHub ⭐
● Check out the Flux docs at: fluxcd.io/docs/get-started/
● GitHub Discussions Q&A:
https://github.com/fluxcd/flux2/discussions/categories/q-a
● CNCF Slack #Flux channel (or get a slack invite)

7. 7
Mar 29: OpenSource101: WTF is GitOps & Why Should you Care?
Mar 30: From Zero to GitOps Heroes!
Mar 31: GitOps for Helm Users!
May 16-20: Flux Booth at KubeCon!
June 8-9: GitOps Days 2022! (gitopsdays.com)
Upcoming Events

8. 8
Talk & Demo Time!

9. Dan Luhring
Manager of Open Source Engineering, Anchore
luhring
danluhring
dan.luhring@anchore.com

10. What’s an SBOM?

11. Software bill of materials (“SBOM”)
● A “list of ingredients” for a software artifact
● Exposes what software is made up of
● Several different uses…
■ Vulnerability scanning
■ Software transparency
■ Policy

12. What is Anchore, Syft, Grype?

13. Anchore
Forging the Future of Software Security.
Anchore is creating a more secure software supply chain for
priceless peace of mind.

14. Anchore’s Open Source Tools
Developer-friendly scanning tools for container image security

15. The story of SBOMs at Flux
Cloud Native Computing Foundation (CNCF)
The Cloud Native Computing Foundation (CNCF) is an open source software foundation that promotes the
adoption of cloud-native computing.
Maturity Levels: Sandbox ➡ Incubating ➡ Graduation
CNCF projects have a maturity level of sandbox, incubating, or graduated, which corresponds to the
Innovators, Early Adopters, and Early Majority tiers of the Crossing the Chasm diagram. The maturity
level is a signal by CNCF as to what sorts of enterprises should be adopting different projects.
July 2019: Flux joins CNCF as a Sandbox Project 🏜 ⌛ 🏝
July 2020: Flux was one of only two projects in the ‘adopt’ category of CNCF CD Tech Radar 📡 ⚙ 💻
March 2021: Flux goes from Sandbox to Incubation 🥚 ⏲
November 2021: Flux Security Audit concludes in preparation for Graduation application 📄 📝
March 2022: Flux applies for Graduation 🤞🤞 🎉 🎓 🎉 🎓 🎉 🎓 🤞🤞

16. Here’s how Flux did it!
Initialize artifact
.goreleaser.yml

17. Here’s how Flux did it!
Install Syft

18. Here’s how Flux did it!
Generate release artifacts
Create release and SBOM

19. Syft, Grype, & Syft+Grype

20. Flux @ Anchore!

21. Flux at Anchore
How we use Flux:
● We manage 2 clusters using Flux
● Environments are set up differently
● Image Automation
What I love about Flux:
● Developer empowerment
● Flexibility in deployments
● Source of truth for deployments
● Uses native kubernetes mechanisms