Write a Kyverno ClusterPolicy using verifyImages to enforce that all pods in a namespace use only images signed with a keyless cosign signature from a trusted GitHub Actions workflow
domain: kyverno.io · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Define a ClusterPolicy resource with a rules entry containing type: Verifyimages and an imageReferences pattern matching the target registry and image name glob
In the attestors block, specify type: Keyless with the issuer set to https://token.actions.githubusercontent.com and the subject set to the GitHub Actions workflow ref (e.g., https://github.com/<ORG>/<REPO>/.github/workflows/<FILE>.yml@refs/heads/main)
Set mutateDigest: true in the verifyImages rule to have Kyverno rewrite the image tag to the verified digest in the pod spec, preventing tag mutation attacks after verification
Apply the policy and verify it is active using kubectl get clusterpolicy and kubectl describe clusterpolicy <NAME>; test it by deploying a pod with a signed image and confirming it is admitted, then try an unsigned image and confirm it is rejected
Enable the Kyverno image verification cache (enabled by default) to reduce repeated registry lookups for the same image digest; set imageVerificationCache.ttlDuration in the Kyverno ConfigMap to control cache lifetime
Known gotchas
Kyverno verifyImages intercepts pod admission; if the Kyverno webhook is unavailable and the failurePolicy is set to Fail, all pod creation in the cluster will be blocked — set appropriate failurePolicy and configure Kyverno's high-availability mode in production
The subject field in the Keyless attestor must exactly match the identity embedded in the Fulcio certificate at signing time; partial matches are not supported — use subjectRegExp for wildcard matching across workflow branches
Kyverno verifyImages rules apply to the final resolved image reference in the pod spec; if a mutating webhook has already modified the image reference before Kyverno evaluates it, the verified identity may not match the original signing identity
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?