Lab 05 — Enforce Trusted Images with Admission Policies

Mission Information

Item	Details
Lab ID	K8S-IMAGE-SECURITY-LAB-05
Difficulty	Advanced
Estimated Time	5–6 Hours
Environment	Kubernetes Training Cluster
Platform	Kubernetes, Cosign, Kyverno, Sigstore Policy Controller or Gatekeeper
Primary Role	Kubernetes Security Engineer
Supporting Roles	DevSecOps Engineer, Cloud Security Engineer, Platform Engineer, SOC Analyst
Module	Kubernetes Container Image & Supply Chain Security
Previous Lab	Lab 04 — Sign and Verify Container Images
Next Lab	Runbook 01 — Container Image Security Assessment

Mission Scenario

CloudNova Technologies has successfully implemented:

Secure container builds
Multi-stage Docker images
Image vulnerability scanning
SBOM generation
Secure private registries
Image signing
Image attestation
Image verification

Despite these improvements, security engineers discover a serious weakness.

Nothing currently prevents developers from deploying:

Unsigned images
Images from Docker Hub
Images from unknown registries
Images signed by unauthorised identities
Images with missing SBOMs
Images without vulnerability attestations
Mutable image tags
Unapproved repositories

Although developers are expected to follow security procedures, Kubernetes itself does not enforce these requirements.

During a Red Team exercise an attacker gains access to a development namespace.

The attacker deploys:

an unsigned image
from Docker Hub
using the latest tag
with no SBOM
no signature
and no security review

The Pod successfully starts.

CloudNova Technologies has therefore decided to move from trust by convention to trust by enforcement.

Only approved workloads meeting enterprise software supply-chain requirements must be admitted into Kubernetes.

Your mission is to implement enterprise admission controls that automatically reject workloads violating organisational security policy.

Learning Objectives

By completing this lab you will learn how to:

Understand Kubernetes Admission Controllers
Understand Validating Admission Policies
Compare Kyverno, Gatekeeper and Sigstore Policy Controller
Deploy admission controllers
Configure image verification policies
Require trusted registries
Require immutable image digests
Require Cosign signatures
Validate trusted identities
Validate attestations
Block mutable tags
Configure audit mode
Configure enforce mode
Create policy exceptions
Test policy failures
Review admission logs
Build enterprise image governance

Enterprise Admission Architecture

Developer

      │

      ▼

kubectl apply

      │

      ▼

Kubernetes API Server

      │

      ▼

Admission Controller

      │

      ├───────────────┐
      │               │
      ▼               ▼

Image Policy     Signature Verification

      │               │

      ▼               ▼

Registry Trust    Attestation Review

      │               │

      └───────────────┘

              │

      Policy Decision

      │

 ┌────┴─────┐

 ▼          ▼

ALLOW     DENY

Enterprise Trust Flow

Image Build

      │

      ▼

Security Scan

      │

      ▼

SBOM

      │

      ▼

Cosign Signature

      │

      ▼

Private Registry

      │

      ▼

Admission Policy

      │

      ▼

Deployment Allowed

Lab Outcomes

By the end of this lab you will have:

Installed an admission policy engine
Configured trusted registries
Configured trusted signing keys
Configured image verification
Required immutable image digests
Required signed images
Tested unsigned deployments
Tested mutable tags
Tested Docker Hub deployments
Tested invalid signatures
Configured audit mode
Configured enforce mode
Reviewed admission logs
Implemented policy exceptions
Produced an enterprise admission assessment

Prerequisites

Before starting ensure you have:

Kubernetes Cluster
kubectl
Helm
Cosign
Signed image from Lab 04
Private Registry
Kyverno or Sigstore Policy Controller
Completion of previous labs

Tools Used

Tool	Purpose
Kubernetes	Cluster
kubectl	Administration
Helm	Install controllers
Kyverno	Policy Engine
Cosign	Signature Verification
Trivy	Image Scan Review
jq	JSON Review

Recommended Lab Structure

lab-05-admission-policy/

├── policies/
│   ├── trusted-registry.yaml
│   ├── verify-images.yaml
│   ├── require-digest.yaml
│   ├── trusted-identities.md
│   ├── exceptions.yaml
│   └── enterprise-policy.md
│
├── manifests/
│   ├── signed-app.yaml
│   ├── unsigned-app.yaml
│   ├── dockerhub-app.yaml
│   ├── latest-tag.yaml
│   └── invalid-signature.yaml
│
├── reports/
│   ├── audit-results.md
│   ├── enforcement-results.md
│   ├── admission-events.md
│   └── assessment.md
│
└── evidence/

Task 01 — Review Existing Admission Controllers

Review enabled admission plugins.

kubectl api-resources

Review cluster configuration.

Understand:

Mutating Admission
Validating Admission
Dynamic Admission
Policy Engines

Task 02 — Install Kyverno

Using Helm:

helm repo add kyverno https://kyverno.github.io/kyverno/

helm repo update

helm install kyverno kyverno/kyverno \
-n kyverno \
--create-namespace

Verify.

kubectl get pods \
-n kyverno

Task 03 — Validate Installation

kubectl get deployments \
-n kyverno

Confirm:

Admission Controller
Cleanup Controller
Reports Controller

Task 04 — Review Policy Modes

Understand:

Audit Mode

Policy violation recorded
Deployment allowed

Enforce Mode

Deployment blocked
Admission rejected

Task 05 — Configure Trusted Registry Policy

Example:

Only allow:

registry.cloudnova.local

Amazon ECR

Azure ACR

Google Artifact Registry

Reject:

docker.io

quay.io

random registries

Task 06 — Apply Registry Policy

kubectl apply \
-f policies/trusted-registry.yaml

Verify.

kubectl get cpol

Task 07 — Test Docker Hub Deployment

Deploy:

image:
nginx:latest

Expected.

Admission Denied

Task 08 — Require Immutable Digests

Policy.

Reject.

image:
nginx:latest

Require.

image:
registry.company/app@sha256:xxxxxxxx

Task 09 — Test Mutable Tag

Deploy.

image:
payment-api:v1

Expected.

Rejected

Task 10 — Configure Image Signature Verification

Create verification policy.

Configure.

trusted public key
approved identities
approved issuer

Task 11 — Apply Verification Policy

kubectl apply \
-f policies/verify-images.yaml

Task 12 — Deploy Signed Image

Deploy.

signed-app.yaml

Expected.

Deployment Allowed

Task 13 — Deploy Unsigned Image

Deploy.

unsigned-app.yaml

Expected.

Admission Denied

Task 14 — Deploy Invalid Signature

Deploy image.

Expected.

Signature Verification Failed

Task 15 — Deploy Wrong Identity

Expected.

Identity Validation Failed

Task 16 — Configure Trusted Identities

Document.

Production CI/CD

Release Pipeline

Security Team

Platform Team

Reject:

Personal accounts
Shared identities
Unknown issuers

Task 17 — Configure Attestation Policy

Require:

Vulnerability Scan
SBOM
Build Review

Task 18 — Test Missing SBOM

Deploy image.

Expected.

Rejected

Task 19 — Test Missing Vulnerability Attestation

Expected.

Rejected

Task 20 — Configure Audit Mode

Update policy.

validationFailureAction:
Audit

Deploy failing workload.

Review reports.

Task 21 — Review Audit Reports

kubectl get policyreports -A

Review.

violations
warnings
policy names

Task 22 — Switch to Enforce Mode

validationFailureAction:
Enforce

Apply.

Task 23 — Verify Enforcement

Deploy:

unsigned image
mutable tag
Docker Hub image

Expected.

Rejected.

Task 24 — Review Admission Events

kubectl get events -A

Review denial messages.

Task 25 — Configure Exception Policy

Example.

Namespace:
security-testing

Duration:
24 hours

Approved By:
Security Team

Task 26 — Test Exception

Deploy unsigned image inside exception namespace.

Expected.

Allowed.

Outside namespace.

Rejected.

Task 27 — Review Policy Logs

Review controller logs.

kubectl logs \
deployment/kyverno-admission-controller \
-n kyverno

Review.

denied
allowed
policy matched

Task 28 — Simulate Supply Chain Attack

Attempt deployment.

Docker Hub

latest tag

unsigned

no SBOM

Expected.

Rejected.

Task 29 — Simulate Registry Compromise

Deploy image.

Signed by:

Unknown Key

Expected.

Rejected.

Task 30 — Test Expired Identity

Deploy.

Expected.

Rejected.

Task 31 — Test Revoked Signing Key

Expected.

Rejected.

Task 32 — Review Policy Performance

Measure.

Admission latency
Policy execution
Verification duration

Discuss operational impact.

Task 33 — Configure Enterprise Policy Documentation

Create.

enterprise-policy.md

Include.

Registry rules
Identity rules
Signature rules
Exceptions
Emergency process

Task 34 — Enterprise Assessment

Review.

Control	Status
Trusted Registry
Immutable Digest
Signed Images
Trusted Identity
SBOM
Vulnerability Scan
Audit Mode
Enforce Mode
Exceptions
Admission Logs

Task 35 — Evidence Collection

Collect.

Policies
Controller Logs
Admission Events
Audit Reports
Enforcement Results
Successful Deployment
Failed Deployments

Task 36 — Cleanup

Delete.

Test deployments
Exception namespace
Temporary policies

Verify.

kubectl get pods -A

Enterprise Admission Security Checklist

Control	Status
Trusted Registry Only	☐
Signed Images Only	☐
Immutable Digests	☐
Trusted Identities	☐
Trusted Issuer	☐
Vulnerability Attestation	☐
SBOM Required	☐
Audit Mode Tested	☐
Enforce Mode Enabled	☐
Exceptions Controlled	☐
Logs Reviewed	☐
Policy Approved	☐

Risk Classification

Critical

Admission Disabled
Unsigned Images Allowed
Public Registry Allowed
Unknown Signing Keys

High

Mutable Tags
Missing SBOM
Missing Vulnerability Scan
Audit Only in Production

Medium

Exception Not Reviewed
Missing Reports
Weak Documentation

Low

Naming
Labels
Metadata

Skills Developed

After completing this lab you will be able to:

Deploy admission controllers
Configure trusted registries
Configure image verification
Validate Cosign signatures
Enforce immutable digests
Validate SBOMs
Validate attestations
Configure audit mode
Configure enforce mode
Build enterprise admission policies
Secure Kubernetes software supply chains

Knowledge Check

Question 1

Why should admission policies verify image signatures?

Answer: To ensure only trusted and approved container images are deployed into the Kubernetes cluster.

Question 2

Why are immutable image digests preferred over tags?

Answer: Digests uniquely identify immutable image content, while tags can be changed or overwritten.

Question 3

What is the difference between Audit mode and Enforce mode?

Answer: Audit mode records policy violations but allows deployments, whereas Enforce mode blocks deployments that violate policy.

Question 4

Why should public registries such as Docker Hub generally be restricted in production?

Answer: Restricting public registries helps ensure that workloads originate only from approved, controlled repositories that meet organisational security requirements.

Question 5

Does image signing eliminate the need for runtime security monitoring?

Answer: No. Image signing verifies software integrity and provenance, while runtime security monitoring detects malicious or unexpected behaviour after deployment.

Lab Summary

In this lab, you implemented enterprise Kubernetes admission controls to enforce software supply chain security. You deployed an admission policy engine, configured trusted registries, required immutable image digests, validated Cosign signatures, enforced trusted identities, verified security attestations, and tested both audit and enforcement modes.

You also simulated common supply chain attacks—including unsigned images, mutable tags, untrusted registries, and invalid signatures—and confirmed that properly configured admission policies prevent these workloads from being deployed.

These controls form a critical layer of Kubernetes defence by ensuring that only approved, verified, and trusted container images reach the cluster.

What’s Next?

Next: Runbook 01 — Kubernetes Container Image Security Assessment

In the next runbook, you will perform a comprehensive enterprise assessment of container image security, reviewing image build pipelines, vulnerability scanning, SBOM generation, registry governance, image signing, admission policies, runtime deployment practices, and overall software supply chain maturity against industry best practices such as CIS Kubernetes Benchmark, NIST SP 800-190, SLSA, and Supply-chain Levels for Software Artifacts (SLSA).