From 53ae36a92bdf0d634cbe3651e0144b9e4b14753c Mon Sep 17 00:00:00 2001 From: juvdiaz Date: Thu, 4 Jun 2026 17:50:07 -0600 Subject: [PATCH] Start image validation in audit mode --- README.md | 13 +++++++++---- .../local-registry-image-policy.yaml | 7 ++++--- apps/website/lang/en.php | 4 ++-- apps/website/lang/nah.php | 4 ++-- 4 files changed, 17 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 745a83a..be90aa8 100644 --- a/README.md +++ b/README.md @@ -337,7 +337,7 @@ are clean, individual policies can be promoted to `Enforce` in the images built by this repo and pushed to the local registry. The policy targets `192.168.100.68:30500/php-website:*` and `192.168.100.68:30500/demos-static:*`, mutates admitted pods to image digests, -and denies pods unless the image has both: +and audits whether the image has both: - a valid Cosign signature from the homelab signing key - a signed SPDX SBOM attestation @@ -347,9 +347,14 @@ state files live under `.lab/`, which is ignored by Git. `./lab.sh apps` creates or reuses `.lab/cosign.key`, publishes `.lab/cosign.pub` into the Kyverno namespace as `homelab-cosign-public-key`, builds images with BuildKit SBOM attestations, signs the pushed images, attaches a signed SPDX SBOM predicate, and -verifies both artifacts before refreshing the workload Applications. Set -`COSIGN_PASSWORD` if you want to manage the key password externally; otherwise -the Debian runner creates `.lab/cosign.password` for non-interactive runs. +verifies both artifacts before refreshing the workload Applications. The policy +starts in `Audit` mode so an existing live deployment can recover while the +current images are signed; after `./lab.sh apps` verifies both images, change +`validationActions` in +`apps/supply-chain-policy/local-registry-image-policy.yaml` from `Audit` to +`Deny` to make it admission-enforcing. Set `COSIGN_PASSWORD` if you want to +manage the key password externally; otherwise the Debian runner creates +`.lab/cosign.password` for non-interactive runs. ## DNS Cache diff --git a/apps/supply-chain-policy/local-registry-image-policy.yaml b/apps/supply-chain-policy/local-registry-image-policy.yaml index 660ff9e..d3bf522 100644 --- a/apps/supply-chain-policy/local-registry-image-policy.yaml +++ b/apps/supply-chain-policy/local-registry-image-policy.yaml @@ -8,12 +8,13 @@ metadata: policies.kyverno.io/severity: high policies.kyverno.io/subject: Pod policies.kyverno.io/description: >- - Requires homelab-built local registry images to have a valid Cosign - signature and a signed SPDX SBOM attestation before pods are admitted. + Audits homelab-built local registry images for a valid Cosign signature + and a signed SPDX SBOM attestation. Promote validationActions to Deny + after the current images have been signed and verified. spec: failurePolicy: Fail validationActions: - - Deny + - Audit webhookConfiguration: timeoutSeconds: 15 evaluation: diff --git a/apps/website/lang/en.php b/apps/website/lang/en.php index 876d07d..999b073 100644 --- a/apps/website/lang/en.php +++ b/apps/website/lang/en.php @@ -149,7 +149,7 @@ return [ 'blog_stack_15' => 'OpenWrt is handled separately from the Debian golden-node template. The lab downloads the upstream ARM SystemReady EFI image, imports it as VM 9050 on nvme_thin_pool, and keeps it disabled unless LAB_OPENWRT_VM=true is set.', 'blog_stack_16' => 'The monitoring layer now includes Prometheus Stack, Grafana, Loki, Promtail, node-exporter, and kube-state-metrics, with placement guardrails so platform add-ons stop defaulting to the control plane.', 'blog_stack_17' => 'The portfolio website keeps Apache at the core, runs PHP through PHP-FPM with OPcache, pre-renders read-heavy pages into static HTML during the image build, and leaves PHP for write and translation endpoints.', - 'blog_stack_18' => 'The supply-chain path now uses BuildKit SBOM attestations, Cosign signatures, a cluster-published public key, and a Kyverno ImageValidatingPolicy that denies unsigned local-registry pods.', + 'blog_stack_18' => 'The supply-chain path now uses BuildKit SBOM attestations, Cosign signatures, a cluster-published public key, and an audit-first Kyverno ImageValidatingPolicy that can be promoted to deny unsigned local-registry pods.', 'blog_arch_kicker' => 'Architecture map', 'blog_arch_title' => 'The homelab, end to end', 'blog_arch_intro' => 'The current delivery path starts with a push to Gitea, runs local validation, builds arm64 images, syncs the validated commit into the GitOps mirror, and lets Argo CD reconcile from the app workers. The infrastructure path stays manual through lab.sh, including the PXE/Pimox template builder, NVMe-backed worker clones, Kyverno policy placement, and the opt-in OpenWrt firewall VM, while the OCI edge routes public traffic back through the private path.', @@ -173,7 +173,7 @@ return [ 'blog_activity_13' => 'Installed the monitoring stack and moved platform add-ons such as Argo CD, Kyverno, and prometheus-stack work toward app-worker placement instead of treating the control plane as spare capacity.', 'blog_activity_14' => 'Reworked the website image to keep Apache as the web server while moving PHP execution to PHP-FPM, enabling OPcache, and validating the runtime through Gitea Actions instead of local image builds.', 'blog_activity_15' => 'Pre-rendered the read-heavy website pages into static HTML, moved visitor ideas behind a small JSON endpoint, added cache headers, enabled HTTP/2 and connection reuse at the OCI edge, and measured reused HTTP/2 asset loads around 60ms.', - 'blog_activity_16' => 'Added image signing and SBOM enforcement: lab.sh now builds with SBOM metadata, signs php-website and demos-static with Cosign, attaches signed SPDX SBOM attestations, and Kyverno denies unsigned local-registry pods.', + 'blog_activity_16' => 'Added image signing and SBOM validation: lab.sh now builds with SBOM metadata, signs php-website and demos-static with Cosign, attaches signed SPDX SBOM attestations, and Kyverno audits unsigned local-registry pods before enforcement is promoted.', 'blog_todo_kicker' => 'Improvement backlog', 'blog_todo_title' => 'Todo list for the next homelab pass', 'blog_todo_intro' => 'These are improvement proposals, not chores for the sake of chores. Each item either reduces rebuild risk, tightens supply-chain hygiene, or makes the platform easier to operate when something fails.', diff --git a/apps/website/lang/nah.php b/apps/website/lang/nah.php index 7af85c2..74a2f94 100644 --- a/apps/website/lang/nah.php +++ b/apps/website/lang/nah.php @@ -149,7 +149,7 @@ return [ 'blog_stack_15' => 'OpenWrt handled separately from Debian golden-node template. Lab downloads upstream ARM SystemReady EFI image, imports it as VM 9050 on nvme_thin_pool, ihuan keeps disabled unless LAB_OPENWRT_VM=true.', 'blog_stack_16' => 'Monitoring layer axcan includes Prometheus Stack, Grafana, Loki, Promtail, node-exporter, ihuan kube-state-metrics, ika placement guardrails para platform add-ons ma amo default to control plane.', 'blog_stack_17' => 'Portfolio website keeps Apache at core, runs PHP through PHP-FPM ika OPcache, pre-renders read-heavy pages into static HTML during image build, ihuan leaves PHP para write ihuan translation endpoints.', - 'blog_stack_18' => 'Supply-chain path axcan uses BuildKit SBOM attestations, Cosign signatures, public key ipan cluster, ihuan Kyverno ImageValidatingPolicy in quidenies unsigned local-registry pods.', + 'blog_stack_18' => 'Supply-chain path axcan uses BuildKit SBOM attestations, Cosign signatures, public key ipan cluster, ihuan audit-first Kyverno ImageValidatingPolicy in huel mopromote para deny unsigned local-registry pods.', 'blog_arch_kicker' => 'Architecture mapa', 'blog_arch_title' => 'Homelab, end to end', 'blog_arch_intro' => 'Current delivery path starts ika push to Gitea, runs local validation, builds arm64 images, syncs validated commit into GitOps mirror, ihuan lets Argo CD reconcile from app workers. Infrastructure path stays manual through lab.sh, including PXE/Pimox template builder, NVMe-backed worker clones, Kyverno policy placement, ihuan opt-in OpenWrt firewall VM, while OCI edge routes public traffic back through private path.', @@ -173,7 +173,7 @@ return [ 'blog_activity_13' => 'Installed monitoring stack ihuan moved platform add-ons such as Argo CD, Kyverno, ihuan prometheus-stack toward app-worker placement instead of treating control plane as spare capacity.', 'blog_activity_14' => 'Reworked website image para Apache ma mocahua web server while PHP runs through PHP-FPM, OPcache enabled, ihuan runtime validated through Gitea Actions instead of local image builds.', 'blog_activity_15' => 'Pre-rendered read-heavy website pages into static HTML, moved visitor ideas behind small JSON endpoint, added cache headers, enabled HTTP/2 ihuan connection reuse at OCI edge, ihuan measured reused HTTP/2 asset loads around 60ms.', - 'blog_activity_16' => 'Added image signing ihuan SBOM enforcement: lab.sh axcan builds ika SBOM metadata, signs php-website ihuan demos-static ika Cosign, attaches signed SPDX SBOM attestations, ihuan Kyverno quidenies unsigned local-registry pods.', + 'blog_activity_16' => 'Added image signing ihuan SBOM validation: lab.sh axcan builds ika SBOM metadata, signs php-website ihuan demos-static ika Cosign, attaches signed SPDX SBOM attestations, ihuan Kyverno audits unsigned local-registry pods before enforcement is promoted.', 'blog_todo_kicker' => 'Improvement tlatecpanaliztli', 'blog_todo_title' => 'Todo list para next homelab pass', 'blog_todo_intro' => 'Inin cateh improvement proposals, amo chores zan pampa chores. Each item either reduces rebuild risk, tightens supply-chain hygiene, o makes platform easier to operate quema tlein fails.',