cilock-k8s¶

Proof-of-concept Kubernetes validating admission webhook that only admits pods whose container images have verifiable witness / cilock attestations.

cilock-k8s flow: build-time attestation and admission-time verification

A pod referencing an attested image is admitted; anything else is denied by the API server with the verification failure as the error message.

Two variants exist: main verifies with the cilock / rookery attestation library, while the witness-poc branch uses upstream in-toto go-witness and the witness CLI (fully published modules — no local checkouts needed).

Guides¶

How it works — every stage explained: what each dev/ script creates and why, and how admission-time verification works.
Try it yourself — hands-on demo walkthrough with expected output, experiments (tampered image, wrong key, unlabeled namespace), and troubleshooting.
Use it with your app — attest your own image, create and sign your policy, deploy and enforce.

Quickstart¶

git clone https://github.com/manzil-infinity180/cilock-k8s
cd cilock-k8s
make e2e   # kind cluster + registry + attest + deploy + admission test

Expected final line:

E2E PASSED: attested image admitted, unattested image denied

Source¶

github.com/manzil-infinity180/cilock-k8s — a modernization of testifysec/judge-k8s by Cole Kennedy, rebuilt on the cilock / rookery attestation library.