Agent skill
kyverno-image-validation-templates
Kyverno image validation: registry allowlists, digests, signatures, and CVE scanning gates for K8s supply chain security.
Install this agent skill to your Project
npx add-skill https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/enforce/skills/kyverno-image-validation-templates
SKILL.md
Kyverno Image Validation Templates
When to Use This Skill
Enforce container image security controls before deployment. These policies validate image sources, require cryptographic signatures, enforce digest-based references, and block images with critical vulnerabilities.
Implementation
Phased Rollout Recommended
Start with registry controls and digest requirements before adding signature verification and CVE scanning. This minimizes disruption while building security layers progressively.
1. Start with Registry Allowlists
Block untrusted registries before enforcing signatures or scans.
kubectl apply -f registry-allowlist-policy.yaml # Registry controls first
kubectl get clusterpolicy -w # Watch for Ready status
2. Add Digest Requirements
Enforce immutable image references.
kubectl apply -f digest-enforcement-policy.yaml # Digest enforcement
kubectl get clusterpolicy -w
3. Implement Image Signing
Verify images come from trusted sources.
kubectl apply -f signature-verification-policy.yaml # Signature verification
kubectl get clusterpolicy -w
4. Enforce CVE Scanning
Block vulnerable images based on scan attestations.
kubectl apply -f cve-scanning-policy.yaml # CVE gates
kubectl get clusterpolicy -w
5. Centralize Base Images
Standardize on approved, maintained base images.
kubectl apply -f base-image-policy.yaml # Base image enforcement
kubectl get clusterpolicy -w
Examples
See examples.md for code examples.
Related Patterns
- Kyverno Labels →
- Kyverno Pod Security →
- Kyverno Resource Limits →
- Template Library Overview →
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
adaptive-enforcement-lab/claude-skills
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
adaptive-enforcement-lab/claude-skills
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
adaptive-enforcement-lab/claude-skills
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
adaptive-enforcement-lab/claude-skills
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
adaptive-enforcement-lab/claude-skills
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
adaptive-enforcement-lab/claude-skills
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
Didn't find tool you were looking for?