Observed Signal · May 4, 2026 · Technical Guide · Source: DEV Community · Impact: 2/5 · Sentiment: Positive
Enforce Kubernetes Image Provenance with Cosign & Kyverno
A developer experiment demonstrates enforcing image provenance in Kubernetes so the cluster only runs cryptographically signed container images. The workflow uses GitLab CI/CD as the build-and-trust origin, Cosign/Sigstore to sign and publish OCI image signatures, an OCI registry to store images and signatures, and Kyverno as a Kubernetes admission controller to verify signatures and enforce policies. The author tested the approach on a local MicroK8s cluster, published example GitLab pipeline snippets and a Kyverno ClusterPolicy that resolves image digests, fetches Cosign signatures from the registry, and allows or rejects Pod creation based on verification. A reference GitHub repository with code and configs is provided.
Practical how-to showing end-to-end container image provenance enforcement for Kubernetes clusters; relevant to infrastructure and supply‑chain security but not a major platform policy change.
Track GitHub Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- GitLab CI/CD is used to build container images, push them to an OCI registry, and sign them in the pipeline.
- Cosign (part of the Sigstore project) attaches cryptographic signatures to OCI images and stores signatures as registry artifacts.
- Kyverno enforces a ClusterPolicy at admission time to verify Cosign signatures, resolve image digests, and allow or deny Pod creation.
- MicroK8s was used as a lightweight local Kubernetes environment for testing the end-to-end workflow.
- Reference implementation and configuration are available at https://github.com/trottomv/microk8s-cosign-kyverno.
Connected Companies & Entities
1 Entity mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
CI ran untrusted code; cilock provides signed provenance
The article describes recent supply‑chain incidents where CI pipelines executed credential‑stealing code (a force‑pushed git tag in aquasecurity/trivy-action and malicious .pth files in litellm PyPI releases) and explains that existing CI workflow YAMLs cannot prove what code actually executed. It introduces CI/Lock (cilock), a tooling layer that traces a build process (via ptrace or eBPF), records files read, environment and artifacts, and produces an in‑toto/DSSE-signed attestation. The attestation plus a signed policy enables verification of exactly what ran during a build, improving provenance and mitigating supply‑chain risks in CI pipelines. Publication date: 2026-06-30.
Automate Kubernetes Image Vulnerability Scanning
This technical walkthrough shows how to enforce image vulnerability scanning in Kubernetes by using the ImagePolicyWebhook admission plugin. The guide explains configuring the Admission Controller (admission-control.conf) to call an external scanner (examples use Trivy), creating a kubeconfig pointing the API server to the scanner endpoint (https://acg.trivy.k8s.webhook:8090/scan), and enabling ImagePolicyWebhook in the kube-apiserver manifest. The article demonstrates testing by deploying a known-good Pod (which is allowed) and a known-vulnerable Pod (which is rejected by the webhook). The approach enforces a fail-closed posture so unverified container images cannot be admitted to clusters.
Solo-built production GitOps platform on AWS EKS
An infrastructure engineer documented building a production-style GitOps platform on AWS EKS around the Spring PetClinic microservices (7 services). The platform is fully provisioned with Terraform (remote state on S3 + DynamoDB) and uses GitHub Actions with OIDC to build Docker images and push to Amazon ECR. CI bumps image tags in a Helm values-driven chart; Argo CD reconciles the cluster (git as source of truth). Autoscaling is implemented at two layers (HPA for pods and Karpenter for nodes). Observability is provided by Prometheus, Grafana and Zipkin. The project is reproducible via a Makefile (provision, up, down). The author describes several production issues and fixes (tracing misconfiguration, CI tag mismatches, Argo CD vs HPA replica conflict, Karpenter IAM policy size) and publishes the infrastructure and app repos and a live demo URL.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.