🚫 Enforcing Signatures at Admission Time

Signing images is pointless unless something blocks unsigned images from running. Two tools dominate: Kyverno and Cosign's Sigstore Policy Controller.

Option A — Kyverno Image Verification Policy

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: Enforce
  rules:
  - name: check-image-signature
    match:
      any:
      - resources:
          kinds: [Pod]
    verifyImages:
    - imageReferences:
      - "ghcr.io/myorg/*"
      attestors:
      - entries:
        - keyless:
            subject: "https://github.com/myorg/myapp/.github/workflows/build.yml@refs/heads/main"
            issuer: "https://token.actions.githubusercontent.com"
      # Optionally require SBOM attestation too
      attestations:
      - predicateType: https://cyclonedx.org/bom
        conditions:
        - all:
          - key: "{{ bomFormat }}"
            operator: Equals
            value: "CycloneDX"

Option B — Sigstore Policy Controller

The Policy Controller (formerly cosign policy) is a purpose-built admission webhook from the Sigstore project, installed via Helm:

# Install Policy Controller
helm repo add sigstore https://sigstore.github.io/helm-charts
helm install policy-controller sigstore/policy-controller -n cosign-system --create-namespace

# Label a namespace to enforce verification
kubectl label namespace production policy.sigstore.dev/include=true

# Define a ClusterImagePolicy

apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: myorg-images
spec:
  images:
  - glob: "ghcr.io/myorg/**"
  authorities:
  - keyless:
      url: https://fulcio.sigstore.dev
      identities:
      - issuer: https://token.actions.githubusercontent.com
        subjectRegExp: "https://github.com/myorg/.*"

Private Registry Allow-listing (Defence-in-Depth)

Even with signature verification, a belt-and-suspenders approach is to block images from untrusted registries entirely. A Kyverno policy for this:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
spec:
  validationFailureAction: Enforce
  rules:
  - name: allowed-registries
    match:
      any:
      - resources: { kinds: [Pod] }
    validate:
      message: "Image must be from ghcr.io/myorg or registry.mycompany.internal"
      pattern:
        spec:
          containers:
          - image: "ghcr.io/myorg/* | registry.mycompany.internal/*"

🔏 cosign & the Sigstore Ecosystem

Sigstore is a Linux Foundation project that makes signing software artifacts as easy as HTTPS — no key management nightmares, no separate PKI. Its three components:

Keyless Signing (preferred)

With keyless signing, you never manage a long-lived private key. Instead, your CI identity (e.g. GitHub Actions OIDC token) is used to get a short-lived cert from Fulcio, sign the image, and record everything in Rekor.

Signing an Image with cosign

# Build and push first
docker build -t ghcr.io/myorg/myapp:v1.2.3 .
docker push ghcr.io/myorg/myapp:v1.2.3

# Keyless sign (requires OIDC — runs in CI, no key needed)
COSIGN_EXPERIMENTAL=1 cosign sign ghcr.io/myorg/myapp:v1.2.3

# Key-based sign (long-lived key alternative)
cosign generate-key-pair            # produces cosign.key + cosign.pub
cosign sign --key cosign.key ghcr.io/myorg/myapp:v1.2.3

# Verify (keyless — checks Rekor + Fulcio cert chain)
COSIGN_EXPERIMENTAL=1 cosign verify \
  --certificate-identity-regexp="https://github.com/myorg/myapp" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/myorg/myapp:v1.2.3

# Verify (key-based)
cosign verify --key cosign.pub ghcr.io/myorg/myapp:v1.2.3

Attestations — Going Beyond Signatures

A signature says "I built this." An attestation carries a verifiable claim about the artifact — SLSA provenance, vulnerability scan results, SBOM, test results.

# Attach a SLSA provenance attestation (generated by slsa-github-generator)
cosign attest \
  --predicate provenance.json \
  --type slsaprovenance \
  ghcr.io/myorg/myapp@sha256:abc123...

# Verify the attestation
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="..." \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/myorg/myapp@sha256:abc123...