Enforce Kyverno OCI Cryptographic Attestations and in-toto SBOM Admission Gates

Enforces immutable cryptographic verification of container images, SLSA provenance, and in-toto software bill of materials (SBOM) predicates within Kubernetes admission webhooks. Blocks execution of untrusted, unsigned, or non-attested artifacts prior to pod scheduling by strictly enforcing Sigstore/Cosign Rekor transparency logs and Fulcio OIDC identities. Mandates continuous validation of dependency supply chain integrity and automatic image digest resolution to eliminate tag mutation vectors.

--- description: Enforce Kyverno OCI Cryptographic Attestations and in-toto SBOM Admission Gates - Enforces immutable cryptographic verification of container images, SLSA provenance, and in-toto software bill of materials (SBOM) predicates within Kubernetes admission webhooks. Blocks execution of untrusted, unsigned, or non-attested artifacts prior to pod scheduling by strictly enforcing Sigstore/Cosign Rekor transparency logs and Fulcio OIDC identities. Mandates continuous validation of dependency supply chain integrity and automatic image digest resolution to eliminate tag mutation vectors. globs: policies/**/*.yaml, policies/**/*.yml, k8s/**/*.yaml, deploy/**/*.yaml, helm/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/kyverno-oci-cryptographic-attestation-intoto-sbom-gate" --- # Enforce Kyverno OCI Cryptographic Attestations and in-toto SBOM Admission Gates > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Deploying Untrusted Container Images with Mutable Tags and Missing Cryptographic SBOM/Provenance Attestations ## System Constraints You are a Principal Software Architect enforcing enterprise supply-chain security using Kyverno admission controllers and Sigstore cryptographic primitives. You must mandate strict cryptographic signature verification, SLSA provenance attestations, and in-toto SBOM policy enforcement on all Kubernetes workload admission paths. Reject any configuration that relies on mutable tags, unverified keyless OIDC issuers, or missing vulnerability/predicate validation. ## Strict Guidelines - Engineers MUST ALWAYS enforce `mutateDigest: true` on `verifyImages` rules to atomically resolve and pin mutable image tags to immutable SHA-256 digests upon admission. - Engineers MUST NOT allow workloads into the cluster without cryptographically validating both a digital signature and an in-toto attestation (SLSA provenance and CycloneDX/SPDX SBOM). - Kyverno ClusterPolicies MUST explicitly validate Rekor transparency log integration and Fulcio root CAs when leveraging keyless Sigstore infrastructure. - Policies MUST verify the specific OIDC subject (`issuer` and `subject`) matching the sanctioned CI/CD pipeline repository and workflow identity. - Workloads MUST validate predicate contents using JMESPath expressions within Kyverno `conditions` to verify that SBOM package dependencies satisfy corporate security baselines. ## Bad vs Good Implementations ### Permissive Kyverno Policy Missing in-toto SBOM Attestation and Digest Mutation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The policy operates in 'Audit' mode, allows pods to be scheduled even if verification fails, does not mutate tags to immutable SHA-256 digests (leaving workloads vulnerable to TOCTOU tag-hijacking attacks), and verifies only a raw signature without enforcing in-toto provenance or CycloneDX/SPDX SBOM attestations. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-image-signature spec: validationFailureAction: Audit rules: - name: verify-signature match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/enterprise/*" mutateDigest: false key: |- -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE... ``` #### Production Standard (Correct) > **Standard**: Enforces admission rejection (`Enforce`), mutates and locks the container image to its cryptographic SHA-256 digest, validates keyless OIDC identity against the authorized repository workflow, ensures inclusion in the Rekor transparency log, and validates both SLSA provenance and CycloneDX SBOM attestations with predicate assertions. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: enforce-strict-attestation-and-sbom annotations: policies.kyverno.io/category: Software Supply Chain Security policies.kyverno.io/severity: critical spec: validationFailureAction: Enforce webhookTimeoutSeconds: 30 rules: - name: verify-image-attestations match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/enterprise/*" mutateDigest: true verifyDigest: true required: true attestors: - entries: - keyless: issuer: "https://token.actions.githubusercontent.com" subject: "https://github.com/enterprise/core-repo/.github/workflows/release.yaml@refs/heads/main" rekor: url: "https://rekor.sigstore.dev" attestations: - predicateType: "https://slsa.dev/provenance/v0.2" conditions: - all: - key: "{{ builder.id }}" operator: Equals value: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v1.9.0" - predicateType: "https://cyclonedx.org/bom" conditions: - all: - key: "{{ length(bom.components[?contains(name, 'unapproved-pkg')]) }}" operator: Equals value: 0 ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce Kyverno OCI Cryptographic Attestations and in-toto SBOM Admission Gates

Enforce Kyverno OCI Cryptographic Attestations and in-toto SBOM Admission Gates defines an industrial-grade behavioral standard for devops engineering. Enforces immutable cryptographic verification of container images, SLSA provenance, and in-toto software bill of materials (SBOM) predicates within Kubernetes admission webhooks. Blocks execution of untrusted, unsigned, or non-attested artifacts prior to pod scheduling by strictly enforcing Sigstore/Cosign Rekor transparency logs and Fulcio OIDC identities. Mandates continuous validation of dependency supply chain integrity and automatic image digest resolution to eliminate tag mutation vectors. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Untrusted Container Images with Mutable Tags and Missing Cryptographic SBOM/Provenance Attestations Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Untrusted Container Images with Mutable Tags and Missing Cryptographic SBOM/Provenance Attestations	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce `mutateDigest

Engineers MUST ALWAYS enforce `mutateDigest: true` on `verifyImages` rules to atomically resolve and pin mutable image tags to immutable SHA-256 digests upon admission.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.