How Shopify Governs Containers at Scale with Grafeas and Kritis - Shopify

This post details Shopify's adoption of Grafeas for storing container metadata and Kritis for enforcing deployment policies on Kubernetes. It highlights how Grafeas enables auditing of container origins, package contents, and security vulnerabilities, while Kritis uses signed attestations from authorities (e.g., 'built-by-us', 'tested') to enforce deployment policies, preventing the deployment of non-compliant containers. The post also mentions generating attestations for Kubernetes workload manifests using kubeaudit.