Q: Your CI/CD pipeline builds a Docker image and pushes it to ECR. How do you ensure that only container images explicitly built and signed by your CI/CD pipeline can actually run in your Kubernetes production cluster?

To secure the software supply chain against image substitution or tampering, we must implement Image Signing and Admission Control.

• Signing: During the CI/CD pipeline, after the image is built and vulnerability scanned successfully, we use a tool like Cosign or Docker Content Trust (Notary) to digitally sign the image hash using a private cryptographic key from our KMS. The signature is pushed to the registry alongside the image.
• Enforcement: In the production Kubernetes cluster, we deploy an Admission Controller (like Kyverno or OPA Gatekeeper). When the API server receives a request to create a Pod, the admission controller intercepts it.
• Verification: The admission controller pulls the signature from the registry and verifies it against our trusted Public Key before allowing the Pod to start. If developers try to kubectl run an unsigned image directly, K8s rejects it.