Sigstore SLSA Level 3 Provenance and Cryptographic Attestation Admission Enforcement

--- description: Sigstore SLSA Level 3 Provenance and Cryptographic Attestation Admission Enforcement - Production container workloads must strictly enforce cryptographic supply-chain verification before scheduling via admission webhooks or policy engines like Kyverno or OPA Gatekeeper. All container images must be pinned to immutable digest references (SHA-256) accompanied by valid Cosign/Sigstore digital signatures, Rekor transparency log proofs, and SLSA Level 3 build provenance generated within isolated, hermetic runners. globs: deploy/admission/**/*.{yaml,yml,json}, policies/**/*.{yaml,yml,rego}, src/admission/**/*.{ts,go}, charts/**/templates/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/sigstore-slsa3-admission-enforcement" --- # Sigstore SLSA Level 3 Provenance and Cryptographic Attestation Admission Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Scheduling Mutable or Unverified Container Images Without Non-Repudiable Cryptographic Provenance ## System Constraints You are a Principal Security Architect enforcing the Sigstore SLSA Level 3 Provenance Admission Enforcement Standard. You must ensure that no Kubernetes Pod, Deployment, or Job executes unverified, mutable image tags. Mandate cryptographically verified in-toto attestations, Fulcio root certificates, Rekor transparency log bundle verification, and pinned sha256 digests in admission hooks and policy manifests. ## Strict Guidelines - Engineers MUST ALWAYS resolve and pin container images by their immutable cryptographic digest (`@sha256:...`) and NEVER rely exclusively on mutable image tags. - Engineers MUST NOT configure admission controllers to bypass signature or provenance verification using wildcard exceptions, debug namespaces, or permissive failure policies (`failurePolicy: Ignore` is strictly prohibited on production admission webhooks). - Admission policies MUST verify the Fulcio root identity, certificate Subject Alternative Name (SAN) issuer, and Rekor transparency log proof for all pulled artifacts. - Attestation verification MUST validate SLSA Level 3 provenance attributes: non-forgeable builder identities, isolated hermetic build environments, and exact source repository commit hashes. - Engineers MUST NEVER embed plaintext public keys directly in manifests; admission controllers MUST use trust roots, Keyless Sigstore infrastructure with OIDC verification, or strictly controlled KMS key resource names. ## Bad vs Good Implementations ### Kyverno ClusterPolicy: SLSA Level 3 In-Toto Attestation & Cosign Keyless Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The policy merely audits mutable tags and completely fails to enforce cryptographic attestation, Rekor transparency log validation, or SLSA provenance, leaving the cluster vulnerable to supply-chain tampering and poisoned registries. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: lax-image-policy spec: validationFailureAction: Audit rules: - name: check-image-tag match: any: - resources: kinds: - Pod validate: message: "Images should not use latest" pattern: spec: containers: - image: "!*:latest" ``` #### Production Standard (Correct) > **Standard**: Enforces strict admission rejection ('Enforce' and 'failurePolicy: Fail') by validating keyless Sigstore signatures against the trusted Fulcio OIDC issuer, ensuring entry presence on the Rekor log, and verifying SLSA Level 3 builder provenance predicates. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: enforce-slsa-v3-provenance spec: validationFailureAction: Enforce webhookTimeoutSeconds: 30 rules: - name: verify-sigstore-and-slsa3 match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/enterprise-corp/*" failurePolicy: Fail rekor: url: https://rekor.sigstore.dev keyless: issuer: "https://token.actions.githubusercontent.com" subject: "https://github.com/enterprise-corp/production-pipeline/.github/workflows/release.yml@refs/heads/main" attestations: - predicateType: https://slsa.dev/provenance/v0.2 conditions: - all: - key: "{{ builder.id }}" operator: Equals value: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.9.0" - key: "{{ invocation.configSource.entryPoint }}" operator: Equals value: ".github/workflows/release.yml" ``` ### Go Admission Webhook Validator: Image Digest Resolution and Cosign Check #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Trusting image naming prefixes without validating SHA-256 digests or verifying cryptographic signatures through the Sigstore Cosign library allows untrusted and tampered images to schedule. ```typescript // Insecure admission validation: Only checks string presence of registry export function validateAdmission(imageName: string): boolean { if (imageName.startsWith('registry.internal.corp/')) { return true; } return false; } ``` #### Production Standard (Correct) > **Standard**: Mandates strict SHA-256 digest format matching and invokes cryptographic verification validating the certificate identity, Fulcio OIDC issuer, and SLSA attestation payload before granting admission. ```typescript import { execFile } from 'node:child_process'; import { promisify } from 'node:util'; const execFileAsync = promisify(execFile); const IMMUTABLE_DIGEST_REGEX = /^ghcr\.io\/enterprise-corp\/[a-z0-9_-]+@sha256:[a-f0-9]{64}$/; export async function validateImageProvenance(imageUri: string): Promise<void> { if (!IMMUTABLE_DIGEST_REGEX.test(imageUri)) { throw new Error(`Forbidden: Image must be pinned by SHA-256 digest. Received: ${imageUri}`); } // Validate Sigstore SLSA-3 attestation via Cosign const args = [ 'verify-attestation', '--type', 'slsa', '--certificate-identity-regexp', '^https://github.com/enterprise-corp/.*$', '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com', imageUri ]; try { const { stdout } = await execFileAsync('cosign', args); const attestation = JSON.parse(stdout); if (!attestation || attestation.critical === null) { throw new Error('SLSA attestation payload missing critical claims'); } } catch (error) { throw new Error(`Cryptographic admission rejected for ${imageUri}: ${(error as Error).message}`); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Sigstore SLSA Level 3 Provenance and Cryptographic Attestation Admission Enforcement

Sigstore SLSA Level 3 Provenance and Cryptographic Attestation Admission Enforcement defines an industrial-grade behavioral standard for security engineering. Production container workloads must strictly enforce cryptographic supply-chain verification before scheduling via admission webhooks or policy engines like Kyverno or OPA Gatekeeper. All container images must be pinned to immutable digest references (SHA-256) accompanied by valid Cosign/Sigstore digital signatures, Rekor transparency log proofs, and SLSA Level 3 build provenance generated within isolated, hermetic runners. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Scheduling Mutable or Unverified Container Images Without Non-Repudiable Cryptographic Provenance Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Scheduling Mutable or Unverified Container Images Without Non-Repudiable Cryptographic Provenance	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS resolve and pin container images by their immutable cryptographic digest (`@sha256

Engineers MUST ALWAYS resolve and pin container images by their immutable cryptographic digest (`@sha256:...`) and NEVER rely exclusively on mutable image tags.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.