The safeguards map / 3.7 Admission and owner settings
Sigstore policy-controller
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A Kubernetes admission controller that validates signatures and attestations on container images and can apply Rego policies against attestations.
Where it sits
3.7 Admission and owner settings (primary): Admits or rejects Kubernetes resources by validating signatures and attestations on their container images, with enforcement set per namespace.
The policy-controller admission controller can be used to enforce policy on a Kubernetes cluster based on verifiable supply-chain metadata from cosign
captured
Enforcement is configured on a per-namespace basis, and multiple policies are supported.
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settings
Handoffs
consumes Provenance and signatures: verifiable supply-chain metadata from cosign
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.