Sigstore Ephemeral OIDC Keyless Rekor Admission Barrier Standard

--- description: Sigstore Ephemeral OIDC Keyless Rekor Admission Barrier Standard - All container workloads deployed to Kubernetes MUST cryptographically verify OIDC-backed short-lived Fulcio certificates and mandatory Rekor transparency log inclusion proofs prior to admission. Admission controllers MUST reject images signed with unpinned OIDC issuers or lacking cryptographic proof of Rekor transparency log commitment, preventing replay of expired or compromised ephemeral certificates. globs: policies/**/*.yaml, k8s/**/*.yaml, deploy/**/*.yaml, charts/**/templates/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-keyless-rekor-admission-barrier-standard" --- # Sigstore Ephemeral OIDC Keyless Rekor Admission Barrier Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Permitting container admission with unverified Fulcio ephemeral certificates, omitted Rekor transparency log verification, or wildcard OIDC identities. ## System Constraints You are a Principal Security Architect enforcing the Sigstore Ephemeral OIDC Keyless Rekor Admission Barrier. You must strictly reject any Kubernetes admission policy (such as Kyverno or Sigstore Policy Controller) that allows container images to skip Rekor transparency log verification, omits precise OIDC issuer and subject pinning, or permits bypass of cryptographic verification at admission time. ## Strict Guidelines - Engineers MUST ALWAYS enforce Rekor transparency log entry verification (inclusion proof and Signed Entry Timestamp) alongside Fulcio ephemeral certificate validation. - Engineers MUST ALWAYS strictly pin both the OIDC issuer URL (e.g., https://token.actions.githubusercontent.com) and the exact subject SAN (Subject Alternative Name) pattern to prevent cross-tenant identity impersonation. - Engineers MUST NOT disable Rekor verification (e.g., setting rekor.ignoreSCT: true or omitting rekor blocks) under any circumstances in production policies. - Admission policies MUST enforce fail-closed behavior (failurePolicy: Fail) so that unavailable transparency infrastructure blocks deployment rather than failing open. - Components NEVER permit ephemeral debug containers, init-containers, or sidecars to bypass the keyless image verification pipeline. ## Bad vs Good Implementations ### Kyverno ClusterPolicy: Insecure Keyless Bypass vs Cryptographic Rekor Admission Barrier #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad policy sets validationFailureAction to Audit (failing open), omits explicit Rekor verification requirements, and uses a wildcard subject SAN ('*'), allowing any actor who can obtain a valid GitHub Actions OIDC token to run code in the cluster without transparency log auditing. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-image-bad spec: validationFailureAction: Audit rules: - name: verify-signature match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/org/*" keyless: # VULNERABLE: Omits Rekor transparency check entirely # VULNERABLE: Wildcard subject allows any GitHub user to deploy issuer: "https://token.actions.githubusercontent.com" subject: "*" ``` #### Production Standard (Correct) > **Standard**: The good policy strictly sets validationFailureAction to Enforce and failurePolicy to Fail. It mandates Rekor verification with ignoreSCT set to false, defines an explicit Rekor service endpoint, and locks down the OIDC subject SAN to the exact authorized GitHub Actions workflow and repository branch. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: verify-image-good spec: validationFailureAction: Enforce rules: - name: verify-keyless-rekor-barrier match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/org/secure-workload:*" failurePolicy: Fail rekor: url: "https://rekor.sigstore.dev" ignoreSCT: false keyless: issuer: "https://token.actions.githubusercontent.com" subject: "https://github.com/org/secure-workload/.github/workflows/deploy.yml@refs/heads/main" roots: |- -----BEGIN CERTIFICATE----- MIIBYzCCAQqgAwIBAgIU... -----END CERTIFICATE----- ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore Ephemeral OIDC Keyless Rekor Admission Barrier Standard

Sigstore Ephemeral OIDC Keyless Rekor Admission Barrier Standard defines an industrial-grade behavioral standard for devops engineering. All container workloads deployed to Kubernetes MUST cryptographically verify OIDC-backed short-lived Fulcio certificates and mandatory Rekor transparency log inclusion proofs prior to admission. Admission controllers MUST reject images signed with unpinned OIDC issuers or lacking cryptographic proof of Rekor transparency log commitment, preventing replay of expired or compromised ephemeral certificates. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting container admission with unverified Fulcio ephemeral certificates, omitted Rekor transparency log verification, or wildcard OIDC identities. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting container admission with unverified Fulcio ephemeral certificates, omitted Rekor transparency log verification, or wildcard OIDC identities.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce Rekor transparency log entry verification (inclusion proof and Signed Entry Timestamp) alongside Fulcio ephemeral certificate validation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.