End-to-End Container Image Signing and Policy Enforcement in Kubernetes

As containerized applications move faster through CI/CD pipelines and into Kubernetes, ensuring the integrity and trustworthiness of what you deploy becomes critical. Without cryptographic signing and enforcement, there is no strong guarantee that the artifacts running in your cluster are the same ones that were built, reviewed, and approved. Container image signing, attestations, and policy enforcement are foundational controls for securing the software supply chain and meeting modern security and compliance expectations.

This demo shows how these controls can be implemented in practice using familiar, developer-friendly tools, without slowing down delivery.

Watch video on YouTube

Demo overview

In this demo, Ben Dewberry, Product Owner at Keyfactor, walks through an end-to-end example of container image signing and policy verification using a GitHub Actions CI/CD pipeline and Kubernetes-native policy controls.

The demo starts by building a simple “Hello World” Java application and packaging it as a JAR file. That JAR is cryptographically signed using SignServer, with keys securely backed by an HSM. The signed artifact is then verified before being used to build a container image, ensuring that only trusted artifacts progress through the pipeline.

Next, the container image itself is signed using Cosign and Signum, again leveraging centrally managed, HSM-backed keys. During this step, a software bill of materials (SBOM) is generated and packaged as an attestation, which is stored alongside the image in the container registry. The demo also shows how these signatures and attestations can be verified as part of the pipeline.

Finally, the signed image is deployed to a Kubernetes cluster, where Kyverno (Converno) enforces a policy that only allows images signed by a trusted CA to run. A side-by-side comparison highlights how signed images are admitted, while unsigned images are automatically blocked.

Key takeaways

This demo demonstrates how artifact signing, container signing, attestations, and Kubernetes policy enforcement can work together to protect the software supply chain, from build to runtime. It shows a practical, scalable approach to enforcing trust using cryptography, while integrating seamlessly into existing CI/CD workflows and cloud-native platforms.