Datadog's Turnstile: Enforcing Software Supply Chain Policies with Signed Attestations
This article details Datadog's Turnstile system, an internal solution designed to evaluate signed attestations and enforce software supply chain policies before deploying container images. It delves into the architectural considerations for securing the deployment pipeline, emphasizing verifiable trust and policy enforcement at critical stages. The system addresses challenges in ensuring the integrity and compliance of software artifacts within a complex distributed environment.
Read original on Datadog BlogIntroduction to Supply Chain Security Challenges
In modern software development, securing the supply chain is paramount. This involves not only signing container images but also verifying various metadata (attestations) about the image's build process, dependencies, and security scans before deployment. Datadog's Turnstile addresses this by acting as a gatekeeper, ensuring that only images meeting predefined security and compliance policies are allowed into production environments. This architectural decision introduces a crucial control point in the deployment pipeline, shifting security left.
Turnstile's Architecture for Policy Enforcement
Turnstile functions by evaluating signed attestations, which are digital proofs about the container image's origin and characteristics. When a deployment request is made, Turnstile intercepts it and performs a series of checks. It queries a backend to retrieve attestations, verifies their signatures, and then applies configured policies. This robust process ensures that every deployed artifact adheres to strict security standards, preventing unauthorized or non-compliant images from running.
Key Components of a Software Supply Chain Security System
A robust system like Turnstile typically involves several integrated components: an attestation generator (e.g., in CI/CD), an attestation storage, a policy engine, a signature verification service, and an enforcement point (like an admission controller in Kubernetes).
Policy Definition and Management
A critical aspect of Turnstile is its ability to define and manage flexible policies. These policies can dictate requirements such as: images must be signed by approved keys, must pass specific vulnerability scans, or must originate from approved build pipelines. The system needs a mechanism for policy storage, versioning, and secure distribution to enforcement points. This design allows for granular control and adaptability to evolving security landscapes.
Integration with Deployment Workflows
Seamless integration into existing CI/CD pipelines and deployment tools (like Kubernetes admission controllers) is crucial for a system like Turnstile. This minimizes friction for developers while maximizing security. The enforcement mechanism must be highly available and performant to avoid becoming a bottleneck in the deployment process, requiring careful consideration of its placement and scaling within the infrastructure.