CCNA Supply Chain Security Questions

OPA/Gatekeeper operates as a validating admission controller that can evaluate the entire Pod spec before creation. By writing a ConstraintTemplate and a Constraint with Rego logic, you can inspect every container's image field, including initContainers and ephemeral containers, and enforce that the image reference begins with your approved registry host. This is the correct approach because admission control is the only layer that can consistently reject non-compliant workloads across all nodes and namespaces.

In-toto attestations are cryptographically signed metadata generated during the CI pipeline that describe the build steps, materials, and results, providing non-repudiation for the image's origin. An admission webhook such as Kyverno can be configured to verify these signatures and attestations at admission time, ensuring that only images produced by the trusted pipeline and with valid provenance are allowed to run. This combination enables robust supply-chain security by tying the runtime state to an auditable, tamper-evident build process.

Using the image digest (e.g., myrepo/app@sha256:…) pins the pull to the exact content-addressed manifest, so any tampering or tag re-pointing produces a different hash and breaks the reference. This defeats tag-mutability and re-tagging attacks, but note the digest is verified against the registry's copy; it does not independently prove the publisher's identity, which is why it is often combined with signatures.

kubesec is a purpose-built static analysis tool that evaluates Kubernetes YAML and JSON manifests against a set of security best practices. It inspects fields such as securityContext, privileged modes, capabilities, hostNetwork, and running as root, and produces a security score along with risk ratings. It works directly on manifest files, either via CLI or as a library, making it a true static analyzer for Kubernetes configurations.

ImagePolicyWebhook is a built-in admission controller that intercepts Pod creation requests and sends the container image names to an external policy service for a decision. It enforces corporate image security policies, such as requiring images to be signed by a trusted authority or pulled from allowed registries. This is the standard Kubernetes mechanism for integrating external image policy engines, and it is distinct from generic webhooks because it is purpose-built for image validation.

Syft generates software bills of materials by scanning container images and filesystems, cataloguing packages and their versions into SPDX or CycloneDX formats. This directly satisfies the stem's requirement to generate SBOMs, complementing analysis tools that consume that output.

Referencing the image with 'image: app@sha256:abc123...' pins the exact immutable manifest by its cryptographic digest. Kubelet fetches that exact digest from the registry, ignoring any tag association, so even if a tag is moved or overwritten, the pods will run the originally audited content. This is the only option that guarantees the image you tested is the image that runs.

Scanning images for known vulnerabilities in CI, using tools like Trivy or Grype, catches flaws in OS packages and language dependencies before they reach production. Integrate these scans with policy checks that fail the build on critical or high severity CVEs, and also rescan base images on a schedule, since new vulnerabilities are disclosed after the image is built. This is a reactive measure against known issues, distinct from verifying who built the image or that it hasn't been altered.

A digest is the cryptographic hash of the image manifest, so referencing myapp@sha256:abc123 pins the exact content. Tags are mutable pointers that can be reassigned to different images, whereas the digest cannot change without altering the reference itself.

An admission control policy, such as an OPA/Gatekeeper ConstraintTemplate or a Kyverno ClusterPolicy, can inspect the containers[].image field in the Pod spec and apply a regex or a list of allowed registry prefixes. This directly enforces that every container, including init containers, only references images from trusted registries at admission time. It is the standard, spec-accurate way to restrict image provenance because the image is a first-class field in the container definition.

Admission webhooks intercept API requests before persistence. The Cosign admission controller is a validating webhook that checks image signatures against trusted keys. If the signature is not valid or the key is untrusted, it rejects the pod creation request. This is the component that enforces the policy at admission time.

The failurePolicy field in Kyverno's ValidatingWebhookConfiguration controls what happens when the webhook cannot be invoked or errors. If set to 'Ignore', any webhook failure is silently ignored and the request proceeds, so the policy would not block the Pod if, for example, the webhook endpoint is unavailable. Additionally, Kyverno policies can have match statements (e.g., specific kinds, namespaces, label selectors) — if this Pod does not match those criteria, the webhook receives the request but the policy simply does not apply to it.

If the OPA constraint's allowlist pattern permits images from 'myregistry.io', then specifying 'myregistry.io/nginx:latest' properly satisfies the image provenance check. The policy inspects the image field in the Pod spec and, if the registry matches the allowed pattern, the admission review passes; this is the correct way to test a compliance requirement without circumventing the control.