TAG post by members of TAG security including Marina Moore, Michael Lieberman, John Kjell, James Carnegie, and Luca Bandini Software supply chain policy…

CNCF's platform is a leading organization driving cloud-native technologies and standards, offering insights into container orchestration, microservices architecture, and cloud-native infrastructure. Through whitepapers, case studies, and community events, CNCF provides insights into adopting cloud-native practices and technologies. Developers and DevOps teams can learn about Kubernetes, Prometheus, and other CNCF projects to build and operate scalable and resilient cloud-native applications.

CNCF

Policy-as-Code is a modern approach that combines software engineering principles with operational and security guidelines to enhance compliance, consistency, and efficiency in software supply chains. It focuses on creating, distributing, and evaluating policies for secure software supply chains. The implementation of policies spans various domains, including infrastructure, platform, source, build, and execution. Effective policy design and evaluation require accuracy, evaluation, and confidence. Trust establishment, policy distribution, and evaluation are crucial aspects of policy implementation. Policy-as-Code tools, such as gatekeepers and policy languages, can be used for policy implementation, enforcement, and evaluation.

Policy-as-Code in the software supply chain

Designing and Evaluating Effective Policies

Tools for Policy Implementation and Evaluation