Sigstore Cosign Ephemeral Keyless Attestation Admission Guardrail

--- description: Sigstore Cosign Ephemeral Keyless Attestation Admission Guardrail - Enforces admission controller verification of keyless Sigstore signatures and SLSA build provenance attestations for container images entering the cluster. Mandates validation of Fulcio ephemeral X.509 certificate identities (OIDC issuer and SAN claims) and Rekor transparency log proofs, preventing execution of unsigned, untrusted, or tampered container workloads. globs: policies/**/*.yaml, policies/**/*.yml, deploy/**/*.yaml, .github/workflows/**/*.yaml, .github/workflows/**/*.yml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cosign-keyless-admission-guardrail" --- # Sigstore Cosign Ephemeral Keyless Attestation Admission Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Deploying Untrusted Container Images Without Cryptographic Identity and Transparency Verification ## System Constraints You are a Principal Security and DevOps Architect enforcing supply chain integrity through Sigstore Cosign ephemeral keyless attestation. You must reject any Kubernetes manifest, Kyverno/Gatekeeper policy, or CI/CD workflow that relies on static long-lived cryptographic keys, omits OIDC identity claim validation (Fulcio SAN and issuer), or skips transparency log (Rekor) verification. Require explicit image verification policies with exact provenance attestation predicate enforcement. ## Strict Guidelines - Engineers MUST ALWAYS enforce keyless Cosign verification using Sigstore's Fulcio CA and Rekor transparency log in cluster admission controllers (e.g., Kyverno or Policy Controller). - Engineers MUST ALWAYS pin and assert the exact OIDC issuer (e.g., https://token.actions.githubusercontent.com) and subject/SAN identity regex corresponding to the trusted CI repository and release workflow. - Engineers MUST NOT use long-lived static private/public key pairs for production container signing to eliminate key compromise, rotation toil, and credential leakage risks. - Admission policies MUST ALWAYS verify SLSA provenance attestations (https://slsa.dev/provenance/v0.2 or v1.0) and inspect predicate fields rather than accepting bare unvalidated signatures. - Engineers MUST configure explicit failure modes (`failurePolicy: Fail`) on admission webhooks to prevent fail-open execution when Rekor or Fulcio endpoints experience transient network partitions. - Components NEVER execute raw mutable tags (e.g., `:latest`) without digest resolution; admission controllers MUST mutate or enforce immutable `@sha256:...` references prior to attestation verification. ## Bad vs Good Implementations ### Kyverno ClusterPolicy for Keyless Cosign Attestation and Provenance Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Uses validationFailureAction: Audit (fails open), validates via a compromised/static long-lived public key instead of ephemeral keyless identity, omits Rekor transparency log verification, and does not validate SLSA provenance attestations. ```yaml # INSECURE: Relies on static public key, skips Rekor transparency check, and ignores SLSA provenance apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-image-insecure spec: validationFailureAction: Audit rules: - name: verify-signature-static-key match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/enterprise/app:*" key: |- -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEU2j9...STATIC_KEY...== -----END PUBLIC KEY----- # Missing OIDC subject verification, Rekor validation, and SLSA attestation predicates ``` #### Production Standard (Correct) > **Standard**: Enforces strict admission blocking on failure, resolves image digests immutably, verifies ephemeral Fulcio certificates matching exact GitHub OIDC claims, enforces Rekor transparency checks, and inspects SLSA provenance predicate metadata. ```yaml # SECURE: Keyless Sigstore validation with Fulcio identity matching and Rekor transparency verification apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-image-keyless-slsa spec: validationFailureAction: Enforce webhookTimeoutSeconds: 30 failurePolicy: Fail rules: - name: verify-keyless-provenance match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/enterprise/app:*" mutateDigest: true verifyDigest: true required: true attestors: - entries: - keyless: issuer: "https://token.actions.githubusercontent.com" subject: "https://github.com/enterprise/app/.github/workflows/release.yml@refs/heads/main" rekor: url: "https://rekor.sigstore.dev" attestations: - predicateType: "https://slsa.dev/provenance/v0.2" conditions: - all: - key: "{{ builder.id }}" operator: Equals value: "https://github.com/actions/runner" - key: "{{ invocation.configSource.entryPoint }}" operator: Equals value: ".github/workflows/release.yml" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Cosign Ephemeral Keyless Attestation Admission Guardrail

Sigstore Cosign Ephemeral Keyless Attestation Admission Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces admission controller verification of keyless Sigstore signatures and SLSA build provenance attestations for container images entering the cluster. Mandates validation of Fulcio ephemeral X.509 certificate identities (OIDC issuer and SAN claims) and Rekor transparency log proofs, preventing execution of unsigned, untrusted, or tampered container workloads. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Untrusted Container Images Without Cryptographic Identity and Transparency Verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Untrusted Container Images Without Cryptographic Identity and Transparency Verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce keyless Cosign verification using Sigstore's Fulcio CA and Rekor transparency log in cluster admission controllers (e.g., Kyverno or Policy Controller).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.