Enforce SLSA Level 3 Ephemeral OIDC Sigstore Attestations via Admission Controllers

--- description: Enforce SLSA Level 3 Ephemeral OIDC Sigstore Attestations via Admission Controllers - Production Kubernetes clusters must reject any workload image lacking tamper-proof SLSA Level 3 build provenance signed via ephemeral OIDC identities (Fulcio/Sigstore) and recorded in the Rekor transparency log. Workload admission controllers (Kyverno or Policy Controller) must cryptographically verify that container digests originate exclusively from designated isolated CI/CD runners matching strict repository subject identity claims. globs: .github/workflows/**/*.{yml,yaml}, k8s/**/*.{yml,yaml}, deploy/**/*.{yml,yaml}, policies/**/*.{yml,yaml}, helm/**/*.{yml,yaml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/slsa-level-3-ephemeral-oidc-sigstore-admission-guardrail" --- # Enforce SLSA Level 3 Ephemeral OIDC Sigstore Attestations via Admission Controllers > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Deploying Mutable Container Images Signed with Static Keys or Lacking Cryptographic SLSA Provenance ## System Constraints You are a Principal Security & Infrastructure Architect enforcing SLSA Level 3 supply chain security. Mandate keyless image signing via Sigstore (Fulcio ephemeral OIDC certificates + Rekor transparency logs) and cluster admission verification (Kyverno/Policy Controller). Prohibit static signing keys, unpinned image digests, and unverified build provenance in production environments. ## Strict Guidelines - Engineers MUST ALWAYS reference container images by immutable SHA-256 digest (`image@sha256:...`) instead of mutable tags in Kubernetes manifests and CI/CD pipelines. - Engineers MUST ALWAYS sign build artifacts and SLSA provenance using keyless ephemeral OIDC credentials from trusted identity providers (e.g., GitHub Actions OIDC token) backed by Fulcio and Rekor. - Admission controllers MUST ALWAYS reject deployment of images that fail cryptographic signature and SLSA Level 3 attestation checks against expected OIDC issuer and subject predicates. - Engineers MUST NOT store long-lived private signing keys or static Cosign passwords in CI/CD secrets or source control. - Pipelines MUST generate SLSA provenance on an isolated, hardened CI builder where build parameters and source references cannot be tampered with by the application build scripts. ## Bad vs Good Implementations ### Kubernetes Admission Policy: Keyless Sigstore SLSA Verification vs Unenforced/Static Keys #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Deploying images using mutable tags ('latest') without cryptographic admission control permits supply chain poisoning, container registry hijacking, and unverified third-party binaries. Using static private keys exposes pipelines to key leakage. ```yaml # Anti-pattern: Permissive admission allowing untrusted or statically signed images with mutable tags apiVersion: apps/v1 kind: Deployment metadata: name: payment-processor spec: replicas: 3 template: spec: containers: - name: app image: ghcr.io/acme-corp/payment-processor:latest # Mutable tag, unverified build origin --- # Flawed CI pipeline: Uses static long-lived cosign key stored in secrets # - run: cosign sign --key env://COSIGN_PRIVATE_KEY ghcr.io/acme-corp/payment-processor:latest ``` #### Production Standard (Correct) > **Standard**: Enforces a Kyverno ClusterPolicy in 'Enforce' mode. Pod creation is rejected unless the image is signed with keyless ephemeral OIDC by the designated repository workflow and includes an authentic SLSA Level 3 builder attestation logged in Rekor. ```yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: check-slsa-provenance-and-signature spec: validationFailureAction: Enforce webhookTimeoutSeconds: 30 rules: - name: verify-sigstore-keyless-and-slsa match: any: - resources: kinds: - Pod verifyImages: - imageReferences: - "ghcr.io/acme-corp/*" attestors: - entries: - keyless: issuer: "https://token.actions.githubusercontent.com" subject: "https://github.com/acme-corp/payment-processor/.github/workflows/release.yml@refs/heads/main" rekor: url: "https://rekor.sigstore.dev" attestations: - predicateType: "https://slsa.dev/provenance/v0.2" conditions: - all: - key: "{{ builder.id }}" operator: Equals value: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v1.9.0" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce SLSA Level 3 Ephemeral OIDC Sigstore Attestations via Admission Controllers

Enforce SLSA Level 3 Ephemeral OIDC Sigstore Attestations via Admission Controllers defines an industrial-grade behavioral standard for devops engineering. Production Kubernetes clusters must reject any workload image lacking tamper-proof SLSA Level 3 build provenance signed via ephemeral OIDC identities (Fulcio/Sigstore) and recorded in the Rekor transparency log. Workload admission controllers (Kyverno or Policy Controller) must cryptographically verify that container digests originate exclusively from designated isolated CI/CD runners matching strict repository subject identity claims. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Mutable Container Images Signed with Static Keys or Lacking Cryptographic SLSA Provenance Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Mutable Container Images Signed with Static Keys or Lacking Cryptographic SLSA Provenance	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS reference container images by immutable SHA-256 digest (`image@sha256

Engineers MUST ALWAYS reference container images by immutable SHA-256 digest (`image@sha256:...`) instead of mutable tags in Kubernetes manifests and CI/CD pipelines.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.