DevSecOps · DevOps
Signed software supply chain
Every container that reaches production is built in CI, scanned, signed and checked at admission. Nothing else gets scheduled.
- Role
- Platform engineer
- When
- 2022 · 5 months
- Industry
- Healthcare SaaS
The problem
Images were built on laptops and pushed straight to the registry. Nobody could prove which commit was running in production, and a HITRUST audit was six months out.
Why it matters
If you can't prove where a binary came from, you can't prove it hasn't been tampered with. Signing and admission policy close the gap between "we reviewed the code" and "the reviewed code is what's running."
How it works
CI builds each image once, generates an SBOM with Syft, scans it with Trivy, and fails on critical CVEs that have a fix available. Cosign signs the image keylessly with the workflow’s GitHub OIDC identity and attaches SLSA provenance.
A Kyverno policy in every cluster rejects any image that isn’t signed by that specific workflow on the main branch. A laptop build can be pushed to the registry, but it can’t be scheduled.
Decisions worth explaining
- Keyless signing. No long-lived signing key to rotate or leak. The signature proves which workflow, repo and commit produced the image.
- Audit mode for two weeks first. The policy logged violations without blocking, which surfaced three forgotten cron jobs before enforcement broke them.
What I’d do next
Verify provenance for third-party base images too, and pin them by digest with automated update PRs.