Supply-Chain on Open Component Model

Component Discovery - the Missing Kubernetes Primitive

Thu, 30 Jul 2026 10:00:00 +0200

The Manual Grind

Platforms like OpenControlPlane run service providers that install and manage services (Flux, Crossplane, Kro, …) on behalf of their users. Each service provider needs to know which versions of a service are available and where to fetch the corresponding artifacts from. Today, that means hardcoding OCI references (image URLs, chart registries, pull secrets) into provider configs, per version, per service:

Shipping SBOMs with Your Components

Tue, 28 Jul 2026 10:00:00 +0200

The Problem

OCM already tells you which artifacts a component delivers: its Software Bill of Delivery. But that does not answer the question a security team actually has: “which dependencies are bundled inside those artifacts, and am I affected by this vulnerability?” Knowing a component ships an OCI image and a CLI binary as a resource does not tell anything about the packages and libraries buried inside that resource.

OCM v2: A Fresh Foundation for Secure Software Delivery

Mon, 30 Mar 2026 10:00:00 +0200

We are excited to announce OCM v2 — a ground-up rebuild of the Open Component Model tooling stack. A new CLI, Kubernetes controllers, and Go library — designed from the start for modularity, security, and community contribution. The entire stack continues to implement the OCM Specification v2, ensuring full compatibility with the standard that defines how components, resources, and signatures are represented.