Module 06 · Artifact · 55 min · You are: Platform team
Verify at admission
In this module
- You learn: Check signatures and signer identity when an image enters the cluster.
- You do: Sign the release digest with keyless identity, install the image policy, try a mismatched signer, and record S06.
- You end with: Admission accepts the exact release identity and refuses the same image signed by another workflow.
CI and admission answer different questions. A verified signature binds identity and digest; the policy must still name the intended workflow precisely.
Open this module in the interactive course to track progress.
Change journey practised: Surface → Test → Measure → Prove
Concepts
- Surface: image admission
- A valid signature from the wrong workflow is still the wrong signer.
- Trust boundary
- A broad identity pattern grants trust to future repositories too.
- Evidence
- Break it: one wildcard admits another signer
Files to know
Open them in your editor or on GitHub; the bullets say what to look at.
start/deploy/policy/verify-images.yaml(reference): Course reference file for this surface.- This is the control or seeded condition examined in this module. L2
start/.github/workflows/release.yml(reference): The small lab fixture used for a bounded test.- This fixture makes the trust assumption visible. L5
Steps
1. Test: admission rejects an unknown signer
Install the pinned Kyverno release and inspect the ImageValidatingPolicy CRD before applying the reference policy. Try the harmless lab image with a different test identity.
kubectl explain imagevalidatingpolicy.spec
2. Measure and prove: bind admission to one identity
Use the exact release workflow subject and a digest. Confirm the mismatched identity is denied, then confirm the intended release digest is admitted. Record S06 and the policy report.
kubectl apply -f devsecops-lab/deploy/policy/verify-images.yaml
A denied rollout should name the policy and identity mismatch in its event or report.
kubectl get events -A --sort-by=.lastTimestamp
Simplified for the workshop
The reference repository is a local learning fixture. Canaries, package publishing and service endpoints are disposable and do not grant access to a real account.
The checks read repository files as data. They do not run learner scripts or install dependencies.
Break it on purpose: Evidence is a repeatable test result tied to an owner, commit and retest.
A teammate makes a small change to save time. Work out which trust assumption it changes before you run the test.
You practise: You practise tracing the cheapest path from an input to a capability and identifying an independent control.
1. Break it
cd devsecops-lab && git diff -- .github/ docs/
2. What you see
Expected: the proof is stopped at the intended boundary. You get a successful path or missing evidence. Read the workflow log and the register entry.
3. Fix it yourself
Restore the intended boundary and rerun the same test. Done when the unsafe path is refused, the evidence is recorded and the files pass the repository validator.
Hint 1
Name who controls the input and what privilege consumes it.
Hint 2
Follow the input to the first capability and remove that trust or privilege.
The fix
Use the test and the exact policy file named above; do not add a blanket permission.
cd devsecops-lab && ./scripts/validate.sh
After you fixed it: the five questions
- What failed?
- A trust boundary allowed untrusted input to reach a useful capability.
- How was it detected?
- The predicted result and observed log did not match; preserve the commit and workflow run as evidence.
- Who responds?
- The owner listed for this surface in docs/attack-surface.yaml.
- How is it corrected?
- Close the specific boundary and repeat the original test.
- How is it prevented?
- Keep a parse-only lab check and a review rule on the owning files.
Quiz
- Which question best identifies the cheapest path?
- Which accepted input reaches the most useful capability with the fewest prerequisites?
- Which scanner has the most findings?
- Which team owns the largest number of files?
- What does a passing signature prove?
- The named identity signed these bytes.
- The source code is harmless.
- The image has no known vulnerabilities.
- When is a surface covered?
- The same bounded test is refused and evidence names the control and owner.
- A scanner has no critical findings.
- A policy file exists in the repository.
Answers
- Which accepted input reaches the most useful capability with the fewest prerequisites? Attack paths follow trust and capability, not tool counts.
- The named identity signed these bytes. Signatures bind identity and bytes, not safety.
- The same bounded test is refused and evidence names the control and owner. Presence is not proof; retest the attack path.
Field note
I ask learners to write the expected signal before they run a test. It makes a control failure easier to tell from a test that never reached the boundary.