What mechanism can I use to block unsigned images from running in my cluster?

Admission controllers are the primary Kubernetes mechanism for enforcing policies on objects during their creation, update, and deletion. A validating admission webhook, a type of admission controller, can be configured to intercept Pod creation requests sent to the API server. This webhook can then invoke an external service to verify that the container images specified in the Pod manifest have valid signatures (e.g., using Sigstore/Cosign). If an image is unsigned or the signature is invalid, the admission controller denies the request, preventing the Pod from being scheduled and thus blocking the image from running in the cluster.

B. Using PodSecurityPolicy (PSP) to enforce image signing and validation.

PodSecurityPolicy (PSP) is a deprecated feature (removed in v1.25) that controlled pod security contexts and did not have a native mechanism for image signature validation.

C. Using Pod Security Standards (PSS) to enforce validation of signatures.

Pod Security Standards (PSS) define security levels for pods (e.g., privileged, baseline, restricted) but do not include controls for verifying image provenance or digital signatures.

D. Configuring Container Runtime Interface (CRI) to enforce image signing and validation.

While some container runtimes can validate image signatures, this is a decentralized, node-level configuration, not a centralized, cluster-wide policy enforcement mechanism managed via the Kubernetes API.

1. Kubernetes Documentation

"Using Admission Controllers": "Admission controllers are plugins that govern and enforce how the cluster is used. They can be thought of as a gatekeeper that intercepts (authenticated) API requests and may change the request object or deny the request altogether." This establishes their role as the primary policy enforcement mechanism.

2. Kubernetes Documentation

"Dynamic Admission Control": Section "What are admission webhooks?" explains how webhooks are used to implement custom admission policies. It states

"Validating admission webhooks... can reject requests to enforce custom policies." This is the specific mechanism used for tasks like signature validation.

3. CNCF

"Cloud Native Security Whitepaper v2"

Section 4.2.2 - Secure

Page 31: "An admission controller can be used to enforce a policy that all images must be signed by a trusted party before they can run in a cluster." This directly links admission controllers to the enforcement of image signing policies.

4. Kubernetes Documentation

"Pod Security Standards (PSS)": This page details the specific controls enforced by PSS

which are related to a pod's Security Context (e.g.

runAsUser

seccompProfile

capabilities). It makes no mention of image signature validation

confirming this is outside its scope.