Mandatory Sigstore Cosign SLSA Provenance and Rekor Bundle Admission Enforcement

--- description: Mandatory Sigstore Cosign SLSA Provenance and Rekor Bundle Admission Enforcement - Enforces non-bypassable admission-time cryptographic verification of in-toto SLSA build provenance attestations and Rekor transparency log bundles for all container images. Images failing cryptographic signature verification, lacking Rekor log inclusion proofs, or referencing mutable tags instead of immutable sha256 digests are denied transition to running state. globs: policies/**/*.{yaml,yml}, k8s/**/*.{yaml,yml}, deployments/**/*.{yaml,yml}, helm/**/*.{yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-cosign-slsa-provenance-admission-standard" --- # Mandatory Sigstore Cosign SLSA Provenance and Rekor Bundle Admission Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Deploying unverified or tag-addressed images without SLSA provenance and Rekor transparency log bundle verification ## System Constraints You are a Principal Security Architect enforcing non-bypassable supply chain security via Sigstore Cosign, in-toto SLSA provenance attestations, and Rekor transparency log verification at the Kubernetes admission controller boundary. All container deployment manifests and admission policies must require strict cryptographic signature validation, immutable digest pins (sha256), validated Rekor bundle inclusion proofs, and explicit OIDC identity matching (Fulcio SAN) or pinned KMS/static verification keys. Zero unverified code may transition into runtime execution. ## Strict Guidelines - Engineers MUST ALWAYS reference container images strictly by immutable cryptographic digest (@sha256:...) and NEVER solely by mutable tag. - Engineers MUST configure admission controllers (Sigstore Policy Controller, Kyverno, or Gatekeeper) with 'failurePolicy: Fail' to prevent fail-open bypass during control plane disruptions. - Admission policies MUST ALWAYS verify the Rekor transparency log entry bundle to prevent usage of revoked or locally forged ephemeral certificates. - Engineers MUST validate the in-toto SLSA attestation predicateType ('https://slsa.dev/provenance/v0.2' or 'https://slsa.dev/provenance/v1') and assert that builder identity matches trusted CI/CD runner workflows. - Admission policies MUST explicitly enforce Fulcio SAN regex checking against the official repository and branch ref when keyless signing is used. - Components NEVER accept unscoped wildcards in admission image matching patterns; policies must explicitly target production namespaces and registry domains. ## Bad vs Good Implementations ### Sigstore Policy Controller ClusterImagePolicy for Rekor and SLSA Provenance Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This policy validates only an arbitrary public key signature without checking transparency log (Rekor) inclusion, lacks SLSA provenance in-toto attestation enforcement, accepts mutable tags, and omits issuer identity verification. ```yaml # INSECURE: Relies on mutable tags, lacks Rekor transparency verification, no SLSA provenance predicate check apiVersion: policy.sigstore.dev/v1beta1 kind: ClusterImagePolicy metadata: name: allow-all-signed spec: images: - glob: "ghcr.io/my-org/*" authorities: - key: data: | -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE... -----END PUBLIC KEY----- ``` #### Production Standard (Correct) > **Standard**: Pinning to sha256 digests, requiring Fulcio keyless OIDC identity validation, checking the Rekor transparency log (ctlog), and validating the SLSA v1 in-toto provenance attestation via Rego prevents unauthorized builds from entering the cluster. ```yaml # SECURE: Enforces keyless Fulcio OIDC verification, Rekor transparency log proof, and in-toto SLSA provenance predicate apiVersion: policy.sigstore.dev/v1beta1 kind: ClusterImagePolicy metadata: name: enforce-slsa-provenance-and-rekor spec: images: - glob: "ghcr.io/my-org/production-workloads@sha256:*" authorities: - keyless: url: "https://fulcio.sigstore.dev" identities: - issuer: "https://token.actions.githubusercontent.com" subjectRegExp: "^https://github\.com/my-org/production-workloads/\.github/workflows/build\.yml@refs/heads/main$" ctlog: url: "https://rekor.sigstore.dev" attestations: - name: slsa-provenance predicateType: "https://slsa.dev/provenance/v1" policy: type: rego data: | package sigstore default is_valid = false is_valid { input.predicate.buildDefinition.buildType == "https://actions.github.com/buildtypes/runner/v1" input.predicate.runDetails.builder.id == "https://github.com/my-org/production-workloads/.github/workflows/build.yml@refs/heads/main" } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory Sigstore Cosign SLSA Provenance and Rekor Bundle Admission Enforcement

Mandatory Sigstore Cosign SLSA Provenance and Rekor Bundle Admission Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces non-bypassable admission-time cryptographic verification of in-toto SLSA build provenance attestations and Rekor transparency log bundles for all container images. Images failing cryptographic signature verification, lacking Rekor log inclusion proofs, or referencing mutable tags instead of immutable sha256 digests are denied transition to running state. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying unverified or tag-addressed images without SLSA provenance and Rekor transparency log bundle verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying unverified or tag-addressed images without SLSA provenance and Rekor transparency log bundle verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS reference container images strictly by immutable cryptographic digest (@sha256

Engineers MUST ALWAYS reference container images strictly by immutable cryptographic digest (@sha256:...) and NEVER solely by mutable tag.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.