Cloud & DevOps / Infrastructure blueprint

Silsila Hardened Pipeline

A secure software delivery blueprint connecting image scanning, SBOM generation, artifact signing, and Kubernetes admission policies.

Explore the architecture ↓View repository ↗
Focus
Infrastructure & platform engineering
Project type
Infrastructure blueprint
Core technologies
Terraform · EKS · Cosign · Kyverno
Silsila Hardened Pipeline concept interface illustration
Concept interface illustration

Context

The engineering problem

Scanning source code is only one part of supply-chain security. Teams also need to trace built artifacts, verify what enters a cluster, and observe workloads after deployment.

System architecture

Architecture at a glance

A simplified map of the intended relationships in this blueprint. Integration gaps are described in the implementation scope; arrows do not establish a running deployment.

  1. clientGitHub source
    Runner workflow
    serviceBuild & scan
  2. serviceBuild & scan
    Source inventory
    serviceSBOM & signing
  3. serviceSBOM & signing
    Intended provenance binding
    infraECR registry
  4. infraECR registry
    Verification policy
    gatewayKyverno / EKS
  5. gatewayKyverno / EKS
    Workload observation
    infraFalco runtime
All system components (6)
  • GitHub sourceclient
  • Build & scanservice
  • SBOM & signingservice
  • ECR registryinfra
  • Kyverno / EKSgateway
  • Falco runtimeinfra

Approach

Implementation decisions

  • Terraform
  • EKS
  • Cosign
  • Kyverno
  • Trivy
  • Falco
  • Syft

Trace the artifact

Syft inventories source dependencies and Cosign signs the resulting SBOM. Binding that inventory to the final container image is a separate integration step.

Check at admission

A Kyverno policy describes signature checks for the configured registry. Its signing-key placeholder and namespace exceptions must be resolved and tested in the target cluster.

Observe runtime behavior

Falco rules and observability modules provide a separate layer for detecting activity after admission.

Explore the implementation

Start with the source.

These entry points connect the architecture to the implementation.

Implementation scope

Terraform modules, Kubernetes policies, and automation scripts form a reference software factory. The SBOM script inventories the source directory; image provenance and the admission policy's key placeholder need integration before deployment.