69 lines
2.3 KiB
YAML
69 lines
2.3 KiB
YAML
apiVersion: policies.kyverno.io/v1
|
|
kind: ImageValidatingPolicy
|
|
metadata:
|
|
name: homelab-local-registry-supply-chain
|
|
annotations:
|
|
policies.kyverno.io/title: Verify Homelab Local Registry Images
|
|
policies.kyverno.io/category: Software Supply Chain Security
|
|
policies.kyverno.io/severity: high
|
|
policies.kyverno.io/subject: Pod
|
|
policies.kyverno.io/description: >-
|
|
Requires homelab-built local registry images to have a valid Cosign
|
|
signature and a signed SPDX SBOM attestation before pods are admitted.
|
|
spec:
|
|
failurePolicy: Fail
|
|
validationActions:
|
|
- Deny
|
|
webhookConfiguration:
|
|
timeoutSeconds: 15
|
|
evaluation:
|
|
background:
|
|
enabled: false
|
|
matchConstraints:
|
|
resourceRules:
|
|
- apiGroups:
|
|
- ""
|
|
apiVersions:
|
|
- v1
|
|
operations:
|
|
- CREATE
|
|
- UPDATE
|
|
resources:
|
|
- pods
|
|
matchImageReferences:
|
|
- glob: "192.168.100.68:30500/php-website:*"
|
|
- glob: "192.168.100.68:30500/demos-static:*"
|
|
validationConfigurations:
|
|
mutateDigest: true
|
|
required: true
|
|
verifyDigest: true
|
|
credentials:
|
|
allowInsecureRegistry: true
|
|
variables:
|
|
- name: homelabSigningKey
|
|
expression: 'resource.Get("v1", "configmaps", "kyverno", "homelab-cosign-public-key")'
|
|
attestors:
|
|
- name: homelabCosign
|
|
cosign:
|
|
key:
|
|
expression: variables.homelabSigningKey.data["cosign.pub"]
|
|
ctlog:
|
|
insecureIgnoreTlog: true
|
|
attestations:
|
|
- name: spdxSbom
|
|
intoto:
|
|
type: https://spdx.dev/Document
|
|
validations:
|
|
- expression: >-
|
|
images.containers.map(image, verifyImageSignatures(image,
|
|
[attestors.homelabCosign])).all(result, result > 0)
|
|
message: local registry image must be signed by the homelab Cosign key
|
|
- expression: >-
|
|
images.containers.map(image, verifyAttestationSignatures(image,
|
|
attestations.spdxSbom, [attestors.homelabCosign])).all(result, result > 0)
|
|
message: local registry image must include a signed SPDX SBOM attestation
|
|
- expression: >-
|
|
images.containers.map(image, extractPayload(image,
|
|
attestations.spdxSbom).SPDXID == "SPDXRef-DOCUMENT").all(result, result)
|
|
message: local registry image SBOM attestation must contain an SPDX document
|