6.1 GitOps + admission

Runtime enforcement means only the signed digest runs. GitOps sets that digest on stage. Unsigned deny is a pull failure, ImagePullBackOff, not an error from oc apply. The Lightwell pins inside the image do not admit an unsigned tag.

You edit one file on the stage remote: admission/trust-policy.yaml, kind: TrustPolicy. You set enforce: true, the live digest, and the pipeline service-account subject from 5.1. CronJob trust-policy-apply in namespace tssc-admission polls about every two minutes and renders ImagePolicy into both stage and prod. Applying a ClusterImagePolicy yourself fails the Check. Red Hat Advanced Cluster Security trusted image signers are a different gate.

Native ImagePolicy signedEmail has to be an email. The 5.1 identity is a Kubernetes service-account URI, so the CronJob renders policyType: PublicKey from ConfigMap lab-cosign-pubkey, the cosign.pub you published on 5.3. The TrustPolicy file still records the 5.1 service-account URI. That remains the Fulcio identity. oc tag copies the image and leaves the .sig tags behind. You cosign copy those tags, then cosign sign --key the destination repository, after the tag.

Lightwell Network and Lightwell Clearinghouse Premier are already inside the image as GAVs. Admission does not inspect Maven. A Premier member version does not skip unsigned deny.

The figure is two remotes. This page is the top row: lw-student/gitops-spring-boot-lw-poc, Application lw-poc-staging, namespace lw-poc-staging. The bottom row is 6.2. Retargeting Application lw-poc-prod at the stage remote fails that later Check.

In a customer engagement you promote a signed digest with GitOps and admit only that identity. You commit to Gitea and fill TrustPolicy. The cluster renders ImagePolicy. A production virtual machine is the same digest on a different runtime, such as bootc or Satellite. This cluster has no virtual machine.

By the end of this module, you will be able to:

ConfigMap demo-userinfo-gitea in namespace gitea holds the URLs. student_gitops_repo_url is stage. student_prod_gitops_repo_url is prod. student_promote_namespace is lw-poc-staging. student_build_namespace is where the signed image lives. student_argocd_app is the stage Application. The password is the value of key student_password. Leave that value out of Git and out of screenshots.

ConfigMap demo-userinfo-admission in namespace tssc-admission names the scored kind and the live kind. Success is the stage and prod URLs, the two namespaces, the Argo CD application name, and scored=TrustPolicy with live=ImagePolicy.

The block below is a TrustPolicy that is still an example: enforce is false, the scope is a foreign registry, and the digest is all zeros. Copying admission-docs example-trust-policy.yaml over the scored file fails the Check.

Tag the signed image into staging. The digest you print has to match the 5.1 digest, including the sha256: prefix. oc tag copies the image. cosign copy copies the signature tags from the build repository to the stage repository. cosign sign --key then signs that destination tag with the 5.3 key, which is what ImagePolicy will check. HOME is /tmp/lab-home for the registry login. The key path stays /home/lab-user/lab-trust/cosign.key.

Clone the stage GitOps remote, student_gitops_repo_url. A fresh clone does not inherit git config from the application repository. Set the author locally, the same identity as 3.2. The password is in the clone URL for this push. It does not belong in a committed file. Success is a clone at /tmp/gitops-stage.

Set image.digest to the digest you just tagged, and leave replicas: 0. Commit and push. Leave the prod remote untouched. PROMOTE.md in the clone names the fields if you need them.

Automated sync often stays on the previous commit, and replicas: 0 can still look Healthy. After the push, hard-refresh the Application. Success of that refresh is sync status, health, and a Deployment whose replicas is 0. Leave the pod stopped. A pull that happens before the node is enforcing ImagePolicy stores the image with no signature. After the policy is on that node, a restart reports already present on machine and no signature exists, and those retries do not start the container.

The capture is Application lw-poc-staging after that refresh: Synced and Healthy, on the signed digest.

Edit admission/trust-policy.yaml on the same stage remote. Leave apiVersion and kind as they are. Set enforce: true. Replace every REPLACE_ME_*. The issuer is https://kubernetes.default.svc, or the userinfo hint oidc_issuer_hint. The subject is the pipeline service-account URI from 5.1. The digest is the signed sha256:…. The scopes are the internal ImageStream repositories that staging and prod actually pull. Discover those names with oc get is. Confirm ConfigMap tssc-admission/lab-cosign-pubkey still holds the 5.3 PEM. The CronJob injects the Fulcio and Rekor material. Pasting those PEMs into TrustPolicy fails the render. The CronJob sets signedIdentity.matchPolicy: ExactRepository to the build ImageStream, so a pull in stage or prod accepts a signature whose identity is lw-poc-build.

The figure is three layers. You edit the top layer, the TrustPolicy file in Gitea. The middle layer is CronJob trust-policy-apply. The bottom layer is the live ImagePolicy in lw-poc-staging and lw-poc-prod. ClusterImagePolicy and the Advanced Cluster Security signer list sit outside that gate.

Success is an ImagePolicy in both namespaces. The object name comes from userinfo policy_name. The CronJob interval is about two minutes.

ImagePolicy reaches the node as a CRI-O policy file, written by the Machine Config Operator. oc get imagepolicy can succeed while the pools are still updating. Wait until both pools list the same updated count as the machine count, and UPDATING is False. Then set replicas: 1, push, and hard-refresh. That first pull is the one the node checks. A later restart of that same pod finds the image already on the machine and starts the container. The Check accepts the Ready pod created after ImagePolicy, once the pools are settled.

Native ImagePolicy is CRI-O policy.json. oc apply of an unsigned Deployment can succeed. The pod fails when the node pulls the image. If this cluster is using the Kyverno fallback, the deny happens at admission instead. Either way, read the pod and the events.

The gate covers spec.scopes. Tag an unsigned digest onto the same ImageStream and deploy that tag. Leave GitOps image.digest on the signed digest. Pointing GitOps at the unsigned tag would flap the Healthy check.

Success is a throwaway pod in ImagePullBackOff or a signature error, the stage Application still Healthy, replicas=1 on the signed Deployment, and ImagePolicy present in both lw-poc-staging and lw-poc-prod. Both MachineConfigPools are done updating. The stage pod’s creation time is later than that ImagePolicy. TrustPolicy has no REPLACE_ME, and enforce is true.

The capture is namespace lw-poc-staging during that test. unsigned-deny-test is ImagePullBackOff. The signed spring-boot-lw-poc pod stays Running. Delete the throwaway Deployment before you leave the page. The command above already does that.

The Job also grades ConfigMap report-15-gitops-admission key live_api. Set it to imagepolicy. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

The scored Check is Job validate-15-gitops-admission in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

The Validate Job grades TrustPolicy, the rendered ImagePolicy, a stage pod created after that policy, and the Healthy stage Application. The next page still opens if you skip this one. Leave prod Argo CD pointed at the prod remote.