Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

--- description: Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification - Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution. globs: .github/workflows/**/*.{yml,yaml}, policies/**/*.{yml,yaml}, k8s/**/*.{yml,yaml}, deploy/**/*.{yml,yaml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-cosign-keyless-attestation-policy-standard" --- # Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Bypassing transparency logs with static long-lived private keys or deploying unverified mutable image tags without admission control ## System Constraints You are a Principal Security Architect enforcing Sigstore Cosign container signing and attestation standards. Mandate keyless OIDC signing via Fulcio and Rekor transparency log integration. Prohibit static private keys in CI/CD pipelines. Require immutable SHA-256 digest referencing and mandatory admission controller verification enforcing precise OIDC issuer and subject SANs. ## Strict Guidelines - Engineers MUST ALWAYS use keyless signing via ambient OIDC credentials (e.g., GitHub Actions `id-token: write`), Fulcio short-lived certificates, and Rekor transparency logs instead of static private keys. - Engineers MUST NOT deploy containers using mutable tags (e.g., `:latest` or `:v1.0.0`); images MUST be pinned to cryptographic SHA-256 digests (`image@sha256:...`) prior to signing and admission check. - Admission controller policies (Kyverno, Sigstore Policy Controller) MUST explicitly assert both the OIDC issuer (`issuer`) and the exact identity/SAN regex (`subject`), refusing wildcard certificates or unverified issuers. - Pipelines MUST attest SLSA provenance and SBOM artifacts using `cosign attest` with `--predicate` rather than merely attaching detached signatures without verifiable metadata. - Admission policies MUST reject any container image whose Rekor transparency log entry is missing, untrusted, or has an unverified certificate expiration window outside the build timeline. ## Bad vs Good Implementations ### GitHub Actions Keyless Cosign Signing and Kyverno Admission Policy #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relies on a long-lived private key stored in CI secrets, exposing it to exfiltration. Signs a mutable tag (`:latest`) rather than an immutable digest, allowing race conditions or downstream image swapping. Completely omits transparency logs (Rekor), Fulcio OIDC verification, and admission controller policies. ```yaml # INSECURE: Uses long-lived static private key, mutable tag, and no admission validation name: Insecure Docker Build and Sign on: push jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: docker build -t myregistry.azurecr.io/app:latest . - run: docker push myregistry.azurecr.io/app:latest - name: Sign Image with Static Key env: COSIGN_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} run: | cosign sign --key env://COSIGN_KEY myregistry.azurecr.io/app:latest ``` #### Production Standard (Correct) > **Standard**: Implements zero-trust container signing by requesting a short-lived OIDC token (`id-token: write`), obtaining an ephemeral certificate from Fulcio, recording the entry in the Rekor transparency log, and pinning the signature to an immutable SHA-256 digest. Enforces signature and provenance admission via a Kyverno ClusterPolicy matching the exact repository workflow identity. ```yaml # SECURE: Ambient OIDC keyless signing, Rekor transparency registration, and Kyverno policy name: Secure Container Attestation on: push: branches: [main] permissions: contents: read id-token: write packages: write jobs: build-and-attest: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: sigstore/[email protected] - name: Build and Push OCI Image id: build run: | IMAGE_NAME="ghcr.io/${{ github.repository }}/service" # Build and get digest DIGEST=$(docker buildx build --push -t "$IMAGE_NAME:sha-${{ github.sha }}" --output type=image,annotation-index.org.opencontainers.image.revision=${{ github.sha }} -q .) echo "digest=$DIGEST" >> $GITHUB_OUTPUT echo "image=$IMAGE_NAME@$DIGEST" >> $GITHUB_OUTPUT - name: Keyless Sign with Fulcio and Rekor run: | cosign sign --yes "${{ steps.build.outputs.image }}" - name: Attest SLSA Provenance run: | cosign attest --yes --predicate provenance.json --type slsaprovenance "${{ steps.build.outputs.image }}" --- # Kyverno ClusterPolicy verifying Fulcio OIDC identity apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: enforce-sigstore-keyless spec: validationFailureAction: Enforce rules: - name: verify-keyless-signature match: any: - resources: kinds: [Pod] verifyImages: - imageReferences: - "ghcr.io/my-org/*" attestors: - entries: - keyless: issuer: "https://token.actions.githubusercontent.com" subject: "https://github.com/my-org/my-repo/.github/workflows/deploy.yml@refs/heads/main" rekor: url: "https://rekor.sigstore.dev" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification defines an industrial-grade behavioral standard for security engineering. Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing transparency logs with static long-lived private keys or deploying unverified mutable image tags without admission control Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing transparency logs with static long-lived private keys or deploying unverified mutable image tags without admission control	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS use keyless signing via ambient OIDC credentials (e.g., GitHub Actions `id-token

Engineers MUST ALWAYS use keyless signing via ambient OIDC credentials (e.g., GitHub Actions `id-token: write`), Fulcio short-lived certificates, and Rekor transparency logs instead of static private keys.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.