Kyverno admission

Admit a pod only when Judge passed its image. Kyverno asks the platform for each image digest, or checks the VSA attached to the image when the cluster has no platform access. In platform Enforce, an image needs an attached VSA only when the platform cannot answer for it or it is referenced by tag. Written for Kyverno 1.19.1; Enforce needs Kyverno 1.19.2 or later (1.19.2-rc.1 until it is released).

The platform verdict endpoint is not live yet. A platform-mode policy rendered now reports “the platform did not answer” in Audit until it ships. Offline mode works today. Enforce needs an attached VSA (cilock attach) only when the platform cannot answer, or for an image referenced by tag: Kyverno skips the VSA check when the platform answers PASSED for every governed image in the pod, and otherwise admits only an image with a trusted PASSED VSA.

In Enforce with fail-closed, a Kyverno outage blocks pod creation in every namespace Kyverno's webhook selects, not only the ones you list here. Kyverno cannot narrow this policy's webhook itself (kyverno/kyverno#18042). Narrowing the Kyverno chart's webhook namespaceSelector to the governed namespaces avoids that, but only on a Kyverno that serves nothing else: the selector is shared, so on a shared Kyverno it switches off every other Kyverno policy outside those namespaces, even while Kyverno is healthy. On a shared Kyverno, keep its selector and choose fail-open, or accept the outage risk.

Enforce needs Kyverno 1.19.2 or later (1.19.2-rc.1 until 1.19.2 is released). Kyverno 1.19.1 and earlier accept a pod that arrives with the kyverno.io/verify-images annotation already set as verified, so anyone who can create pods with annotations can bypass the VSA check. 1.19.2 also adds protect-generation-labels.kyverno.svc, a cluster-wide fail-closed webhook outside the chart's namespaceSelector. It touches only objects a Kyverno generate policy created, so it is harmless without generate policies; with them, a Kyverno outage blocks edits to generated objects in every namespace.

Fill in the namespaces and your image patterns, then render. Nothing is applied to any cluster from here.