In this lesson, you will learn how to cryptographically sign container images using Cosign to ensure that the code running in your cluster is exactly what your CI/CD pipeline produced.
The Problem of Provenance
When a container image is pushed to a registry, it is just a blob of data. Without a signature, there is no way for a Kubernetes cluster to verify if an image was tampered with during transit or if it originated from a malicious actor pretending to be your CI/CD system. Image signing solves this by binding a digital signature to the image digest, creating an immutable audit trail of its origin.
Implementing Signing with Cosign
Cosign is the industry standard for signing OCI artifacts. It operates by generating a key pair: a private key used during the build phase and a public key used during deployment validation.
In your CI/CD pipeline, after successfully pushing an image to your registry, you execute the signing command:
# Sign the image using a private key stored in your CI secret vault
cosign sign --key cosign.key my-registry.com/my-app:latest
When you run this command, Cosign creates a new artifact in the registry (a signature manifest) that links your private key to the image digest. Because the signature is stored as an OCI artifact alongside the image, it persists across registries and mirrors.
Verifying Authenticity
Once the image is signed, the "provenance" of the image is established. You can verify this manually during the pipeline validation stage:
cosign verify --key cosign.pub my-registry.com/my-app:latest
If the signature is valid, Cosign returns the payload metadata, confirming the image hasn't been altered. This process is the foundational step for "Admission Control," where your Kubernetes cluster can be configured to refuse any image that lacks a valid signature, effectively creating a "gated" environment where only authorized, CI-verified code can reach production. By integrating this step into your automated pipeline, you ensure that security is not an afterthought but a mandatory requirement for every deployment.
Key Takeaway: Signing images with Cosign transforms container registries from simple storage bins into verifiable sources of truth, ensuring that only authenticated images can be executed in your environment.