Start image validation in audit mode

README.md

@@ -337,7 +337,7 @@ are clean, individual policies can be promoted to `Enforce` in
 the images built by this repo and pushed to the local registry. The policy
 targets `192.168.100.68:30500/php-website:*` and
 `192.168.100.68:30500/demos-static:*`, mutates admitted pods to image digests,
-and denies pods unless the image has both:
+and audits whether the image has both:
 
 - a valid Cosign signature from the homelab signing key
 - a signed SPDX SBOM attestation
@@ -347,9 +347,14 @@ state files live under `.lab/`, which is ignored by Git. `./lab.sh apps` creates
 or reuses `.lab/cosign.key`, publishes `.lab/cosign.pub` into the Kyverno
 namespace as `homelab-cosign-public-key`, builds images with BuildKit SBOM
 attestations, signs the pushed images, attaches a signed SPDX SBOM predicate, and
-verifies both artifacts before refreshing the workload Applications. Set
+verifies both artifacts before refreshing the workload Applications. The policy
-`COSIGN_PASSWORD` if you want to manage the key password externally; otherwise
+starts in `Audit` mode so an existing live deployment can recover while the
-the Debian runner creates `.lab/cosign.password` for non-interactive runs.
+current images are signed; after `./lab.sh apps` verifies both images, change
+`validationActions` in
+`apps/supply-chain-policy/local-registry-image-policy.yaml` from `Audit` to
+`Deny` to make it admission-enforcing. Set `COSIGN_PASSWORD` if you want to
+manage the key password externally; otherwise the Debian runner creates
+`.lab/cosign.password` for non-interactive runs.
 
 ## DNS Cache
 

apps/supply-chain-policy/local-registry-image-policy.yaml

@@ -8,12 +8,13 @@ metadata:
     policies.kyverno.io/severity: high
     policies.kyverno.io/subject: Pod
     policies.kyverno.io/description: >-
-      Requires homelab-built local registry images to have a valid Cosign
+      Audits homelab-built local registry images for a valid Cosign signature
-      signature and a signed SPDX SBOM attestation before pods are admitted.
+      and a signed SPDX SBOM attestation. Promote validationActions to Deny
+      after the current images have been signed and verified.
 spec:
   failurePolicy: Fail
   validationActions:
-    - Deny
+    - Audit
   webhookConfiguration:
     timeoutSeconds: 15
   evaluation:

apps/website/lang/en.php

@@ -149,7 +149,7 @@ return [
     'blog_stack_15'          => 'OpenWrt is handled separately from the Debian golden-node template. The lab downloads the upstream ARM SystemReady EFI image, imports it as VM 9050 on nvme_thin_pool, and keeps it disabled unless LAB_OPENWRT_VM=true is set.',
     'blog_stack_16'          => 'The monitoring layer now includes Prometheus Stack, Grafana, Loki, Promtail, node-exporter, and kube-state-metrics, with placement guardrails so platform add-ons stop defaulting to the control plane.',
     'blog_stack_17'          => 'The portfolio website keeps Apache at the core, runs PHP through PHP-FPM with OPcache, pre-renders read-heavy pages into static HTML during the image build, and leaves PHP for write and translation endpoints.',
-    'blog_stack_18'          => 'The supply-chain path now uses BuildKit SBOM attestations, Cosign signatures, a cluster-published public key, and a Kyverno ImageValidatingPolicy that denies unsigned local-registry pods.',
+    'blog_stack_18'          => 'The supply-chain path now uses BuildKit SBOM attestations, Cosign signatures, a cluster-published public key, and an audit-first Kyverno ImageValidatingPolicy that can be promoted to deny unsigned local-registry pods.',
     'blog_arch_kicker'       => 'Architecture map',
     'blog_arch_title'        => 'The homelab, end to end',
     'blog_arch_intro'        => 'The current delivery path starts with a push to Gitea, runs local validation, builds arm64 images, syncs the validated commit into the GitOps mirror, and lets Argo CD reconcile from the app workers. The infrastructure path stays manual through lab.sh, including the PXE/Pimox template builder, NVMe-backed worker clones, Kyverno policy placement, and the opt-in OpenWrt firewall VM, while the OCI edge routes public traffic back through the private path.',
@@ -173,7 +173,7 @@ return [
     'blog_activity_13'       => 'Installed the monitoring stack and moved platform add-ons such as Argo CD, Kyverno, and prometheus-stack work toward app-worker placement instead of treating the control plane as spare capacity.',
     'blog_activity_14'       => 'Reworked the website image to keep Apache as the web server while moving PHP execution to PHP-FPM, enabling OPcache, and validating the runtime through Gitea Actions instead of local image builds.',
     'blog_activity_15'       => 'Pre-rendered the read-heavy website pages into static HTML, moved visitor ideas behind a small JSON endpoint, added cache headers, enabled HTTP/2 and connection reuse at the OCI edge, and measured reused HTTP/2 asset loads around 60ms.',
-    'blog_activity_16'       => 'Added image signing and SBOM enforcement: lab.sh now builds with SBOM metadata, signs php-website and demos-static with Cosign, attaches signed SPDX SBOM attestations, and Kyverno denies unsigned local-registry pods.',
+    'blog_activity_16'       => 'Added image signing and SBOM validation: lab.sh now builds with SBOM metadata, signs php-website and demos-static with Cosign, attaches signed SPDX SBOM attestations, and Kyverno audits unsigned local-registry pods before enforcement is promoted.',
     'blog_todo_kicker'       => 'Improvement backlog',
     'blog_todo_title'        => 'Todo list for the next homelab pass',
     'blog_todo_intro'        => 'These are improvement proposals, not chores for the sake of chores. Each item either reduces rebuild risk, tightens supply-chain hygiene, or makes the platform easier to operate when something fails.',

apps/website/lang/nah.php

@@ -149,7 +149,7 @@ return [
     'blog_stack_15'          => 'OpenWrt handled separately from Debian golden-node template. Lab downloads upstream ARM SystemReady EFI image, imports it as VM 9050 on nvme_thin_pool, ihuan keeps disabled unless LAB_OPENWRT_VM=true.',
     'blog_stack_16'          => 'Monitoring layer axcan includes Prometheus Stack, Grafana, Loki, Promtail, node-exporter, ihuan kube-state-metrics, ika placement guardrails para platform add-ons ma amo default to control plane.',
     'blog_stack_17'          => 'Portfolio website keeps Apache at core, runs PHP through PHP-FPM ika OPcache, pre-renders read-heavy pages into static HTML during image build, ihuan leaves PHP para write ihuan translation endpoints.',
-    'blog_stack_18'          => 'Supply-chain path axcan uses BuildKit SBOM attestations, Cosign signatures, public key ipan cluster, ihuan Kyverno ImageValidatingPolicy in quidenies unsigned local-registry pods.',
+    'blog_stack_18'          => 'Supply-chain path axcan uses BuildKit SBOM attestations, Cosign signatures, public key ipan cluster, ihuan audit-first Kyverno ImageValidatingPolicy in huel mopromote para deny unsigned local-registry pods.',
     'blog_arch_kicker'       => 'Architecture mapa',
     'blog_arch_title'        => 'Homelab, end to end',
     'blog_arch_intro'        => 'Current delivery path starts ika push to Gitea, runs local validation, builds arm64 images, syncs validated commit into GitOps mirror, ihuan lets Argo CD reconcile from app workers. Infrastructure path stays manual through lab.sh, including PXE/Pimox template builder, NVMe-backed worker clones, Kyverno policy placement, ihuan opt-in OpenWrt firewall VM, while OCI edge routes public traffic back through private path.',
@@ -173,7 +173,7 @@ return [
     'blog_activity_13'       => 'Installed monitoring stack ihuan moved platform add-ons such as Argo CD, Kyverno, ihuan prometheus-stack toward app-worker placement instead of treating control plane as spare capacity.',
     'blog_activity_14'       => 'Reworked website image para Apache ma mocahua web server while PHP runs through PHP-FPM, OPcache enabled, ihuan runtime validated through Gitea Actions instead of local image builds.',
     'blog_activity_15'       => 'Pre-rendered read-heavy website pages into static HTML, moved visitor ideas behind small JSON endpoint, added cache headers, enabled HTTP/2 ihuan connection reuse at OCI edge, ihuan measured reused HTTP/2 asset loads around 60ms.',
-    'blog_activity_16'       => 'Added image signing ihuan SBOM enforcement: lab.sh axcan builds ika SBOM metadata, signs php-website ihuan demos-static ika Cosign, attaches signed SPDX SBOM attestations, ihuan Kyverno quidenies unsigned local-registry pods.',
+    'blog_activity_16'       => 'Added image signing ihuan SBOM validation: lab.sh axcan builds ika SBOM metadata, signs php-website ihuan demos-static ika Cosign, attaches signed SPDX SBOM attestations, ihuan Kyverno audits unsigned local-registry pods before enforcement is promoted.',
     'blog_todo_kicker'       => 'Improvement tlatecpanaliztli',
     'blog_todo_title'        => 'Todo list para next homelab pass',
     'blog_todo_intro'        => 'Inin cateh improvement proposals, amo chores zan pampa chores. Each item either reduces rebuild risk, tightens supply-chain hygiene, o makes platform easier to operate quema tlein fails.',