GitOps Supply Chain
A Kubernetes delivery project that connects a specific build identity to an admission policy, then makes the workload and its operating constraints reviewable in Git.
Independent project · Source-guided policy demonstrationThe 60-second overview6b7e85bRefresh Career Atlas after public repository changesGitHub Actions builds a Go service and signs its image digest using Cosign keyless signing.
Kyverno verifies the configured workflow identity and issuer for the demo image family, with digest mutation enabled.
Argo CD reconciles applications, policies, and a secret demonstration into the companion ephemeral platform.
A successful image build does not establish who produced a workload or whether it meets a cluster’s baseline. Delivery needs explicit ownership across the build, registry, GitOps controller, and admission boundary.
Choose a stage to explore its purpose and supporting source.
The workflow builds and pushes an image, then signs its digest using an OIDC-backed Cosign identity. It also builds a deliberately unsigned image with a different digest.
Provenance and SBOM generation are explicitly disabled in this workflow. Signing is implemented; attestations are not claimed.
Read the implementationFollow the policy’s intended decision for three different image scenarios.
Demo image + signature from the configured main-branch build workflow
Policy intent: verify signature and bind the admitted image to its digest.
Source-guided illustration. This is not a recorded admission result or cryptographic verification.
Verify a specific keyless signer and issuer instead of distributing a long-lived signing key.
The tradeoffVerification depends on the identity and transparency services. The policy’s image scope must be understood and maintained.
Inspect the decisionBuild an unsigned variant with a distinct digest for rejection checks.
The tradeoffIt creates an intentionally untrusted artifact that must remain clearly separated from the signed deployment.
Inspect the decisionDeclare the runtime security context, resources, and probes alongside the deployment.
The tradeoffThese controls constrain execution but do not replace application testing or establish runtime security by themselves.
Inspect the decisionThe reviewed revision contains both the signing workflow and enforcing verification policy. The older README roadmap understates this implementation.
Supporting sourceRecruiters can follow the configured workflow subject, issuer, image scope, and digest checks directly in the policy.
Supporting sourceSupply-chain security is a chain of specific claims. A signature authenticates an artifact’s source under a trust policy; it does not prove the software is safe. The useful work is in connecting that identity to an explicit admission boundary.
Reviewed 5 September 2026. These links point to the source revision used for this case study.
Keyless signing plus an unsigned comparison artifact.
.github/workflows/build-sign.ymlIdentity, issuer, image scope, and digest verification.
policies/verify-image-signatures.yamlResource, tag, non-root checks, and exclusions.
policies/baseline-hardening.yamlRuntime security context and health probes.
workloads/hello/deployment.yamlRoot application reconciliation.
bootstrap/root-app.yamlThe small application carried through the delivery path.
app/main.goSource revision fb4e387 · View current workflow history ↗