Configure admission-controller image-signature verification using Kyverno or an equivalent controller
domain: kyverno.io · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Define a Kyverno ClusterPolicy with a verifyImages rule specifying the expected image reference pattern and attestor configuration
Configure the attestor block with the appropriate keyless or key-based trust anchor (Fulcio/Rekor for keyless, or a static public key)
Set the mutateDigest option to ensure admitted images are pinned to a verified digest in the pod spec
Deploy the policy in audit mode and review violations before switching to enforce
Test by attempting to deploy an unsigned or differently-signed image and confirm it is blocked
Set up alerting on admission denials to catch attempted policy bypasses
Known gotchas
Image signature verification adds latency to pod admission; if the signature registry or transparency log is unreachable, admission may fail or fall back depending on policy settings
The mutateDigest option changes the running pod spec from a tag to a digest reference, which can surprise operators who inspect running pods and see an unexpected image reference
Wildcard image patterns must be carefully scoped to avoid accidentally requiring signatures for internal base images that are not signed
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?