Cosign 2.4 Rekor Ephemeral OIDC Attestation Admission Guardrail

--- description: Cosign 2.4 Rekor Ephemeral OIDC Attestation Admission Guardrail - Mandates strict zero-trust container admission verification using Cosign 2.4 keyless OIDC signatures verified against Rekor transparency log proofs. Requires immutable digest pinning (sha256), explicit certificate identity (Subject Alternative Name) and issuer constraints, and cryptographically verified in-toto SLSA provenance attestations prior to workload scheduling. globs: policies/**/*.yaml, k8s/**/*.{yaml,yml}, src/admission/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cosign-rekor-ephemeral-oidc-admission-invariants" --- # Cosign 2.4 Rekor Ephemeral OIDC Attestation Admission Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Admitting Mutable Tags with Bypassed Rekor Verification or Unconstrained OIDC Certificate Identities ## System Constraints You are a Principal Security Architect enforcing Cosign 2.4 and Rekor ephemeral OIDC artifact attestation standards across container pipelines and Kubernetes admission webhooks. Mandate zero-trust keyless verification, immutable sha256 digests, Rekor log inclusion proofs, and exact OIDC issuer/subject identity matching. ## Strict Guidelines - Engineers MUST ALWAYS resolve container images to immutable SHA256 digests (`image@sha256:...`) before signature or attestation verification; mutable tags MUST be rejected immediately. - Engineers MUST ALWAYS validate the ephemeral X.509 certificate's SAN (Subject Alternative Name) and OIDC Issuer against an explicit, non-wildcard identity policy (e.g., verifying both `issuer` equals `https://token.actions.githubusercontent.com` and `subject` matches the repository workflow). - Engineers MUST NEVER set `--insecure-ignore-tlog=true` or bypass Rekor transparency log inclusion and integrated timestamp verification during keyless validation. - Admission policies MUST enforce cryptographic verification of in-toto SLSA provenance attestations (`type: slsaprovenance`) alongside standard container image signatures. - Admission verification services MUST fail closed (Deny by default) upon network timeouts, Rekor communication failures, or untrusted Root-of-Trust (Fulcio/Rekor TUF metadata) drift. ## Bad vs Good Implementations ### TypeScript Admission Controller Verification Engine #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accepts mutable image tags, bypasses Rekor transparency log checks with `--insecure-ignore-tlog=true`, and does not validate the Fulcio OIDC certificate subject or issuer, allowing any valid keyless certificate from any GitHub/Google repository to satisfy the gate. ```typescript import { execSync } from 'child_process'; export async function verifyImage(imageRef: string): Promise<boolean> { try { // BAD: Accepts mutable tags, ignores Rekor transparency log, // and omits OIDC identity (SAN/Issuer) verification constraints. execSync(`cosign verify --insecure-ignore-tlog=true ${imageRef}`); return true; } catch { return false; } } ``` #### Production Standard (Correct) > **Standard**: Enforces immutable sha256 digest validation, mandates inclusion verification on the Rekor transparency log (failing closed on failure), and strictly restricts the OIDC Issuer and Subject Alternative Name regex to the verified source repository workflow. ```typescript import { execFile } from 'node:child_process'; import { promisify } from 'node:util'; const execFileAsync = promisify(execFile); interface VerificationConfig { expectedDigestPattern: RegExp; oidcIssuer: string; certIdentityRegex: string; } const CONFIG: VerificationConfig = { expectedDigestPattern: /^([a-z0-9.-]+\/)?[a-z0-9._-]+@[a-f0-9]{64}$/i, oidcIssuer: 'https://token.actions.githubusercontent.com', certIdentityRegex: '^https://github.com/my-org/my-repo/\.github/workflows/deploy\.yml@refs/heads/main$' }; export async function verifyContainerAdmission(imageWithDigest: string): Promise<void> { // 1. Enforce immutable digest pinning if (!CONFIG.expectedDigestPattern.test(imageWithDigest)) { throw new Error(`Rejected: Image must be referenced by immutable sha256 digest: ${imageWithDigest}`); } // 2. Enforce keyless verification with Rekor transparency proof and strict SAN/Issuer validation const args = [ 'verify', '--certificate-oidc-issuer', CONFIG.oidcIssuer, '--certificate-identity-regexp', CONFIG.certIdentityRegex, '--rekor-url', 'https://rekor.sigstore.dev', '--output', 'json', imageWithDigest ]; try { const { stdout } = await execFileAsync('cosign', args, { timeout: 10000 }); const verificationPayload = JSON.parse(stdout); if (!Array.isArray(verificationPayload) || verificationPayload.length === 0) { throw new Error('Cosign returned empty verification payload'); } } catch (error) { throw new Error(`Admission Denied: Cosign verification failed: ${(error as Error).message}`); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cosign 2.4 Rekor Ephemeral OIDC Attestation Admission Guardrail

Cosign 2.4 Rekor Ephemeral OIDC Attestation Admission Guardrail defines an industrial-grade behavioral standard for security engineering. Mandates strict zero-trust container admission verification using Cosign 2.4 keyless OIDC signatures verified against Rekor transparency log proofs. Requires immutable digest pinning (sha256), explicit certificate identity (Subject Alternative Name) and issuer constraints, and cryptographically verified in-toto SLSA provenance attestations prior to workload scheduling. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Admitting Mutable Tags with Bypassed Rekor Verification or Unconstrained OIDC Certificate Identities Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Admitting Mutable Tags with Bypassed Rekor Verification or Unconstrained OIDC Certificate Identities	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS resolve container images to immutable SHA256 digests (`image@sha256

Engineers MUST ALWAYS resolve container images to immutable SHA256 digests (`image@sha256:...`) before signature or attestation verification; mutable tags MUST be rejected immediately.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.