Enforcing Image Provenance with Admission Controllers

In this lesson, you will learn how to shift security enforcement from "best practice" to "mandatory policy" by using Kubernetes admission controllers to cryptographically verify image provenance before a pod is even created.

Up until now, you have been signing images with Cosign and running vulnerability scans during your CI pipeline. However, without an admission controller, an attacker—or a rogue developer—could still deploy an unsigned image or one with critical vulnerabilities simply by bypassing the pipeline. An admission controller acts as a security gatekeeper within the Kubernetes API server that intercepts every request to create a pod.

The Mechanism: Policy as Code

The most common implementation of this concept is via Kyverno or OPA/Gatekeeper. You define a Policy resource that mandates two specific checks for every image being pulled:

1. Signature Verification: Does the image have a valid signature matching your organization's public key?
2. Scan Thresholds: Does the image metadata contain a "clean" report from your security scanning tool?

If the image fails these checks, the admission controller rejects the API request, returning a 403 Forbidden error. Here is a conceptual example of a Kyverno policy rule that requires a signature for all images in a specific registry:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-signature
      match:
        resources:
          kinds:
            - Pod
      verifyImages:
      - imageReferences: ["my-registry.com/*"]
        attestors:
        - entries:
          - keys:
              publicKeys: |-
                -----BEGIN PUBLIC KEY-----
                ... (Your Cosign Public Key) ...
                -----END PUBLIC KEY-----

Why This Matters

By enforcing these rules at the admission controller level, you eliminate the "human factor" in security. You are no longer relying on developers to remember to scan images; the cluster itself refuses to run anything that doesn't meet your provenance standards. Even if someone manually executes a kubectl run command with an untrusted image, the cluster will automatically block the execution, ensuring that only verified, audited, and signed artifacts ever reach your production environment.

Key Takeaway: Admission controllers turn your security policies into immutable laws, ensuring only cryptographically signed and pre-scanned images can be deployed to your cluster.