Appendix: Konflux terminology and workshop equivalents

Use this table when a delivery discussion uses Konflux terminology. The workshop implements related controls with OpenShift Pipelines and other installed services. These are functional comparisons, not claims that the products are interchangeable or that Konflux is installed.

Compare responsibilities

Term in a delivery discussion What the workshop uses Where to inspect it

Konflux build pipeline

OpenShift Pipelines orchestrates Tasks; an OpenShift BuildConfig builds the application image.

4.4 Build and SBOM

Hermeto dependency prefetch

Task prefetch-dependencies in lightwell-tasks prepares the Maven cache from Nexus. The build consumes it with offline Maven.

4.2 Prefetch

Buildah image build

The pipeline starts a binary BuildConfig with oc start-build --from-dir. There is no separate Buildah Task in this path.

4.4

MintMaker dependency updates

An in-cluster Renovate bot opens a Gitea PR for the learner to review and merge.

3.3 Live Renovate

Tekton Chains and provenance

Task cosign-sign-keyless signs the application through RHTAS. This is image signing; the workshop does not generate a Chains provenance attestation.

5.1 Keyless signature

Conforma policy

Task conforma-policy evaluates the learner’s policy copy. The exercise compares signature results for an unsigned builder and the signed application.

5.2 Signature policy

Release Service

A separate production GitOps commit selects the verified digest, and Argo CD reconciles the deployment.

6.2 Production promotion

Image vulnerability and policy assessment

Task acs-image-check calls ACS. Module 7.2 inspects a direct TaskRun against the promoted image and configures future pipeline checks to fail on a skip.

7.2 ACS evidence

Keep policy and provenance distinct

Module 5.2 retains an expected attestation-signature exception because this lab does not produce the corresponding provenance attestation. Read the policy reports as image-signature evidence. Neither keyless signing nor a successful image-signature check establishes a SLSA level.

Track 6 uses TrustPolicy and ImagePolicy to enforce image signatures during runtime image pulls. ACS performs a separate image policy assessment. When explaining an outcome, name the control that produced it and show its result.

Apply the comparison

Use the installed Task and resource names when inspecting the cluster or editing the application pipeline. For a customer using Konflux, map the required inputs, outputs, identities, and acceptance policies to that platform, then validate the actual implementation.

See Consultant delivery map for the broader activities and Delivery readiness review for evidence to discuss after the workshop.