Sigstore In-Toto SLSA Level 3 Attestation Verification at Kubernetes Admission Boundary

--- description: Sigstore In-Toto SLSA Level 3 Attestation Verification at Kubernetes Admission Boundary - Enforces strict zero-trust deployment gates at the Kubernetes admission boundary by verifying Sigstore In-Toto SLSA Level 3 provenance attestations. Images must resolve to immutable digests with validated Fulcio keyless OIDC identity claims, Rekor transparency log proofs, and builder workflow predicates before workloads are scheduled. globs: admission/**/*.{ts,js,go}, policies/**/*.{yaml,yml}, deploy/**/*.{yaml,yml}, k8s/**/*.{yaml,yml}, src/controllers/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-intoto-slsa-provenance-admission-verification" --- # Sigstore In-Toto SLSA Level 3 Attestation Verification at Kubernetes Admission Boundary > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Admitting Images via Mutable Tags or Signature-Only Validation Without Cryptographic In-Toto Build Predicate Verification ## System Constraints You are a Principal Security Architect enforcing the Sigstore In-Toto Supply Chain Attestation Verification Standard. You MUST reject any deployment, admission webhook, or verification pipeline that accepts mutable container tags, bypasses Rekor inclusion proofs, or validates signatures without inspecting the cryptographically bound In-Toto SLSA provenance payload. Enforce immutable image digests, Fulcio OIDC SAN/issuer pinning, and SLSA Level 3 builder identity checks at the Kubernetes admission gate. ## Strict Guidelines - Engineers MUST ALWAYS resolve container references to immutable SHA256 digests (@sha256:...) before performing cryptographic verification and scheduling. - Engineers MUST ALWAYS verify both the Rekor transparency log bundle (inclusion proof and signed entry timestamp) and the Fulcio root-of-trust certificate chain. - Engineers MUST validate the In-Toto predicate payload (https://slsa.dev/provenance/v0.2 or v1.0) and enforce that builder.id, source repository URI, and trigger workflow match hardened parameters. - Engineers MUST NOT allow bypass flags, dry-run allowances in production, or fallback to simple signature verification when SLSA provenance is required. - Admission controllers MUST reject images if the OIDC SAN identity (e.g., GitHub Actions runner claim) or OIDC Issuer does not match the immutable organization allowlist. - Services MUST verify that the subject digest recorded inside the In-Toto statement payload bitwise matches the target container image digest being deployed. ## Bad vs Good Implementations ### Kubernetes Validating Webhook Attestation Verification Handler #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accepts mutable container tags, performs superficial substring checks, and skips Sigstore In-Toto attestation verification, Rekor transparency proofs, and Fulcio OIDC builder identity validation. ```typescript import { Request, Response } from 'express'; interface AdmissionRequestBody { request: { object: { spec: { containers: Array<{ name: string; image: string }>; }; }; }; } export async function handleAdmission(req: Request, res: Response) { const containers = req.body.request.object.spec.containers; for (const container of containers) { // BAD: Accepts mutable tag without verifying digest // BAD: Performs no attestation check or checks signature only without In-Toto predicate verification if (container.image.endsWith(':latest') || container.image.includes('untrusted')) { return res.json({ response: { allowed: false, status: { message: 'Untrusted tag' } } }); } } // BAD: Blindly accepts workloads without validating Fulcio OIDC SAN or Rekor proof return res.json({ response: { allowed: true } }); } ``` #### Production Standard (Correct) > **Standard**: Enforces immutable @sha256 image digest resolution, verifies the Sigstore attestation bundle via Fulcio OIDC identity and Rekor transparency log proof, and strictly parses the In-Toto statement to validate the SLSA Level 3 builder ID and matching image subject digest. ```typescript import { Request, Response } from 'express'; import * as sigstore from '@sigstore/verify'; interface AdmissionRequest { request: { uid: string; object: { spec: { containers: Array<{ name: string; image: string }>; }; }; }; } const EXPECTED_ISSUER = 'https://token.actions.githubusercontent.com'; const EXPECTED_SAN_REGEX = /^https:\/\/github\.com\/org-enterprise\/secure-pipeline\/\.github\/workflows\/release\.yml@refs\/tags\/v[0-9]+\.[0-9]+\.[0-9]+$/; const EXPECTED_BUILDER_ID = 'https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v2.0.0'; const SHA256_DIGEST_REGEX = /^[a-z0-9._/-]+@sha256:[a-f0-9]{64}$/; interface InTotoStatement { _type: 'https://in-toto.io/Statement/v1' | 'https://in-toto.io/Statement/v0.1'; predicateType: string; subject: Array<{ name: string; digest: { sha256: string } }>; predicate: { builder: { id: string }; buildDefinition?: { source?: { uri: string } }; }; } export async function handleAdmission(req: Request, res: Response): Promise<void> { const { uid, object } = (req.body as AdmissionRequest).request; for (const container of object.spec.containers) { if (!SHA256_DIGEST_REGEX.test(container.image)) { res.json({ response: { uid, allowed: false, status: { message: `Image ${container.image} must reference an immutable @sha256: digest.` } } }); return; } const [, expectedDigest] = container.image.split('@sha256:'); try { // Retrieve bundle and verify Sigstore keyless attestation envelope (Fulcio + Rekor) const bundle = await sigstore.fetchAttestationBundle(container.image); const verificationResult = await sigstore.verifyBundle(bundle, { certificateIssuer: EXPECTED_ISSUER, certificateIdentityURI: EXPECTED_SAN_REGEX, tlogOptions: { threshold: 1 } }); const statement = JSON.parse(verificationResult.payload.toString('utf-8')) as InTotoStatement; if (statement.predicateType !== 'https://slsa.dev/provenance/v0.2' && statement.predicateType !== 'https://slsa.dev/provenance/v1') { throw new Error(`Unauthorized predicate type: ${statement.predicateType}`); } if (statement.predicate.builder.id !== EXPECTED_BUILDER_ID) { throw new Error(`Untrusted SLSA builder: ${statement.predicate.builder.id}`); } const matchesDigest = statement.subject.some(s => s.digest.sha256 === expectedDigest); if (!matchesDigest) { throw new Error(`Attestation subject digest does not match image digest ${expectedDigest}`); } } catch (err: unknown) { const message = err instanceof Error ? err.message : 'Attestation verification failed'; res.json({ response: { uid, allowed: false, status: { message: `Admission denied for ${container.image}: ${message}` } } }); return; } } res.json({ response: { uid, allowed: true } }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore In-Toto SLSA Level 3 Attestation Verification at Kubernetes Admission Boundary

Sigstore In-Toto SLSA Level 3 Attestation Verification at Kubernetes Admission Boundary defines an industrial-grade behavioral standard for security engineering. Enforces strict zero-trust deployment gates at the Kubernetes admission boundary by verifying Sigstore In-Toto SLSA Level 3 provenance attestations. Images must resolve to immutable digests with validated Fulcio keyless OIDC identity claims, Rekor transparency log proofs, and builder workflow predicates before workloads are scheduled. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Admitting Images via Mutable Tags or Signature-Only Validation Without Cryptographic In-Toto Build Predicate Verification Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Admitting Images via Mutable Tags or Signature-Only Validation Without Cryptographic In-Toto Build Predicate Verification	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS resolve container references to immutable SHA256 digests (@sha256

Engineers MUST ALWAYS resolve container references to immutable SHA256 digests (@sha256:...) before performing cryptographic verification and scheduling.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.