The safeguards map / 3.7 Admission and owner settings
Kyverno
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A Kubernetes policy engine that checks resources at admission time against the cluster owner's policies and verifies container image signatures and attestations.
Where it sits
3.7 Admission and owner settings (primary): Runs as a Kubernetes admission controller that checks each resource against policies the cluster owner writes, and verifies image signatures and attestations before a workload is admitted.
enforce policies as a Kubernetes admission controller, CLI-based scanner, and at runtime
captured
The Kyverno ImageValidatingPolicy type is a Kyverno policy type designed for verifying container image signatures and attestations.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settings
Handoffs
consumes Provenance and signatures: image signatures and attestations (Sigstore Cosign, Notary)
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.