Supply-Chain Security

Supply-chain security is about trusting what you actually run. A cluster can have perfect RBAC and still be compromised by a malicious or vulnerable container image. The controls here — signing, provenance, SBOMs, scanning, and admission-time verification — close the gap between the registry and the running Pod.

It is the part of security that lives outside the cluster as much as in it, and it has become a first-class concern as attacks increasingly target the build and distribution pipeline rather than the runtime.

The Threat Model

The risk is that the image you run is not what you think it is: a base image with a known vulnerability, a dependency that was tampered with, a tag that was repointed to malicious content, or an image pulled from an untrusted source. Because Kubernetes will faithfully run whatever image you reference, trust has to be established before admission — at build time and at pull time, not after the Pod is already running.

Signing and Verification

Image signing cryptographically binds an image to a signer. The common toolchain is Sigstore/cosign, which signs images (and other artifacts) and supports keyless signing tied to an identity. Verification is enforced at admission: a policy engine or a dedicated verifier checks the signature before allowing the Pod, so an unsigned or untrusted image is rejected. Signing proves origin and integrity; verification is what makes it matter.

Provenance, SBOMs, and Scanning

Beyond "who signed it," you want "how was it built" and "what is in it." Provenance (as formalized by SLSA) attests to the build process. An SBOM (software bill of materials) lists the components and versions inside an image, which is what lets you answer "are we affected by this new CVE?" in minutes instead of days. Scanning checks images against vulnerability databases — in CI before push, and continuously in the registry as new CVEs are disclosed against images you already shipped.

Pinning and Registry Hygiene

Two practical habits prevent most trouble. Pin images by digest, not a mutable tag — a tag like :latest can be repointed, and even a version tag can be overwritten, but a digest is the immutable content. And run from trusted registries with credentials scoped per workload, mirroring or vendoring critical public images rather than pulling them live from the internet. Combine these with admission-time signature verification and you have a chain of trust from build to run.

containers:
  - name: app
    # avoid: image: my-app:latest
    image: registry.example.com/my-app@sha256:9b2c...e1