apiVersion: policies.kyverno.io/v1
kind: ImageValidatingPolicy
metadata:
  name: homelab-local-registry-supply-chain
  annotations:
    policies.kyverno.io/title: Verify Homelab Local Registry Images
    policies.kyverno.io/category: Software Supply Chain Security
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      Audits homelab-built local registry images for a valid Cosign signature
      and a signed SPDX SBOM attestation. Promote validationActions to Deny
      after the current images have been signed and verified.
spec:
  failurePolicy: Fail
  validationActions:
    - Audit
  webhookConfiguration:
    timeoutSeconds: 15
  evaluation:
    background:
      enabled: false
  matchConstraints:
    resourceRules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - pods
  matchImageReferences:
    - glob: "192.168.100.73:30500/php-website:*"
    - glob: "192.168.100.73:30500/demos-static:*"
  validationConfigurations:
    mutateDigest: true
    required: true
    verifyDigest: true
  credentials:
    allowInsecureRegistry: true
  variables:
    - name: homelabSigningKey
      expression: 'resource.Get("v1", "configmaps", "kyverno", "homelab-cosign-public-key")'
  attestors:
    - name: homelabCosign
      cosign:
        key:
          expression: variables.homelabSigningKey.data["cosign.pub"]
        ctlog:
          insecureIgnoreTlog: true
  attestations:
    - name: spdxSbom
      intoto:
        type: https://spdx.dev/Document
  validations:
    - expression: >-
        images.containers.map(image, verifyImageSignatures(image,
        [attestors.homelabCosign])).all(result, result > 0)
      message: local registry image must be signed by the homelab Cosign key
    - expression: >-
        images.containers.map(image, verifyAttestationSignatures(image,
        attestations.spdxSbom, [attestors.homelabCosign])).all(result, result > 0)
      message: local registry image must include a signed SPDX SBOM attestation
    - expression: >-
        images.containers.map(image, extractPayload(image,
        attestations.spdxSbom).SPDXID == "SPDXRef-DOCUMENT").all(result, result)
      message: local registry image SBOM attestation must contain an SPDX document