Turning “Check the Bag” into a Working System
The idea was simple: verify the bag, not the badge.
The hard part is turning that into a system someone can actually build.
This is the actionable roadmap — not a manifesto, not another “zero-trust” slide.
It’s the pragmatic route to the world described in Check the Bag: a unified model where credentials are issued only if the environment proves itself clean.
Task 1 — Identity & Attestation
Goal: unify workload and environment identity under one auditable standard.
- Evaluate SPIFFE/SPIRE as the Identity Control Plane for all non-human workloads.
- SPIRE becomes the source of truth for what runs where, and under what evidence.
- Attestation plugins can integrate OS, hardware, and custom attributes (like the Nix or devcontainer signature from Task 2).
- Every service, job, or build agent receives its identity through SPIRE issuance.
Outcome: a cryptographically provable binding between a workload and its attested environment.
Task 2 — Reproducible Environments
Goal: make “the bag” reproducible and attestable.
- Stand up a PoC comparing Nix and DevContainers for reproducible dev/runtime environments.
- The output must be deterministic: a Nix closure hash or a signed devcontainer manifest.
- Feed that hash into SPIRE’s attestation selector — so credentials can only be issued if the environment matches a known, reproducible build.
- Document developer workflow friction early; this is where usability sinks most pilots.
Outcome: every environment can prove exactly what it is — not just who’s using it.
Task 3 — Policy
Goal: codify trust decisions in one place.
- Adopt Open Policy Agent (OPA) as the global Policy Decision Point (PDP).
- All attestation, identity, and credential issuance checks route through OPA.
-
OPA policies evaluate:
- whether an environment is in policy,
- whether its attestation is valid,
- and what privileges the resulting identity should get.
Extend existing CI/CD gates with
conftestfor developer feedback loops.
Outcome: the organization’s trust logic is versioned, testable, and enforced everywhere.
Task 4 — Provenance
Goal: link build outputs to their attested inputs.
- Require Sigstore signing for all build artifacts.
- Integrate Sigstore’s Rekor log and Fulcio CA for transparent verification.
-
Use SLSA v1.0 as the minimum compliance level; pipelines must produce signed provenance linking:
- the SPIRE-attested environment (from Task 1–2),
- the OPA-approved policy decision (Task 3),
- and the final artifact digest.
Store provenance as evidence, not paperwork.
Outcome: an end-to-end chain of custody — from developer environment to running workload.
Putting It Together
| Pillar | Technology | Function |
|---|---|---|
| Identity | SPIFFE/SPIRE | Verifiable workload identity |
| Environment | Nix / DevContainers | Deterministic, attested environments |
| Policy | OPA / Conftest | Centralized, auditable trust logic |
| Provenance | Sigstore / SLSA | Signed, traceable artifact lineage |
This stack isn’t speculative — it’s all open, CNCF-anchored, and proven at scale.
What’s missing isn’t tech; it’s discipline and integration glue.
Why This Is the Path Forward
Because the opposite has already failed.
- Secrets rotate but drift remains.
- Tokens expire but trust persists unearned.
- “Zero-trust” dashboards glow while production runs on :latest.
This model replaces vibes with verification.
It’s painful, yes — but every painful system you build now prevents a post-incident rebuild later.
Why This Stack, Why Now
Five years ago, you couldn't build this. The pieces didn't exist:
- SPIFFE/SPIRE was alpha code
- SLSA was a Google internal concept
- Sigstore didn't exist
- DevContainers were a VS Code experiment
Today, it's all CNCF-graduated, production-proven, and free.
The industry also just learned the hard cost of NOT doing this:
- CircleCI (2023): Session token theft → full production access
- LastPass (2022): DevOps engineer's compromised laptop → vault breach
- Okta (2024): Support engineer's personal device → customer data access
The pattern is identical: trusted identity + untrusted environment = incident.
The tech to fix this finally exists. The question is whether your org will adopt it before or after your breach.
RC = 0
You don’t need another framework.
You need fewer excuses.
Identity, Environment, Policy, Provenance — that’s the whole playbook.
Pin them, wire them, and stop pretending automation is trust.
Top comments (0)