Configure Image Provenance Image Policy Webhook Admission Controller

# 1) Check which admission plugins are enabled on the API server
#    (GKE Autopilot/Standard uses managed control planes; this is informational)
# Run on: any machine with kubectl access
kubectl get pod -n kube-system -l component=kube-apiserver -o yaml | grep -iE 'admission-control|enable-admission-plugins|admission-plugins' -n

# 2) Discover any ImagePolicyWebhook-related configuration objects
#    (ConfigMap, Secret) that might define webhook settings
# Run on: any machine with kubectl access
kubectl get configmaps,secrets -A | grep -i imagepolicy || true

# 3) List all Mutating and ValidatingWebhookConfigurations
#    to see if any webhooks enforce image provenance
# Run on: any machine with kubectl access
kubectl get mutatingwebhookconfigurations,validatingwebhookconfigurations

# 3a) Inspect details of potential image-related webhooks
# Replace <WEBHOOK_NAME> with a name from the list above that looks image-related
kubectl get validatingwebhookconfiguration <WEBHOOK_NAME> -o yaml
kubectl get mutatingwebhookconfiguration   <WEBHOOK_NAME> -o yaml

# 4) Examine how images are currently used in pods
#    (to help assess whether provenance policies are being followed)
# Run on: any machine with kubectl access
kubectl get pods -A -o jsonpath='{range .items[*]}{@.metadata.namespace}{" "}{@.metadata.name}{" "}{range @.spec.containers[*]}{@.image}{" "}{end}{"\n"}{end}' | sort

# 5) (If you already have an image-policy webhook) test its behavior with a sample pod
#    Create a minimal pod spec using an image that should be rejected under your policy
# Run on: any machine with kubectl access
cat << 'EOF' > /tmp/test-untrusted-image-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: test-untrusted-image
  namespace: default
spec:
  containers:
  - name: c
    image: docker.io/library/busybox:latest
    command: ["sh", "-c", "sleep 3600"]
EOF

kubectl apply -f /tmp/test-untrusted-image-pod.yaml

kubectl describe pod test-untrusted-image -n default

#!/usr/bin/env bash
# Purpose: Report cluster-wide state related to ImagePolicyWebhook / image provenance
# Scope: Run on any machine with kubectl access and current context set

set -euo pipefail

echo "=== 1) Check for ImagePolicyWebhook admission plugin on API server(s) ==="
echo "NOTE: On GKE, control-plane flags are managed by Google; this check can only"
echo "      infer usage from API behavior, not by reading API server flags."

echo
echo "--- 1a) Attempt to discover admission configuration (v1 AdmissionConfiguration) ---"
# This will normally be forbidden on managed control planes; that's expected.
kubectl get validatingadmissionpolicies,validatingwebhookconfigurations,mutatingwebhookconfigurations \
  -A -o wide 2>&1 | sed 's/^/  /'

echo
echo "=== 2) Look for evidence of ImagePolicyWebhook configuration objects ==="
echo "--- 2a) Cluster-wide search for objects whose name suggests image policy usage ---"
kubectl get mutatingwebhookconfigurations,validatingwebhookconfigurations \
  -A -o json 2>/dev/null | jq -r '
  .items[]
  | select(
      (.metadata.name|test("imagepolicy|image-policy|image_provenance|provenance"; "i"))
      or ([.webhooks[].name]|join(",")|test("imagepolicy|image-policy|image_provenance|provenance"; "i"))
    )
  | "Kind: \(.kind), Name: \(.metadata.name)\n  Webhooks: \([.webhooks[].name] | join(", "))\n"
' || echo "  (No webhook configurations matching common image policy naming patterns found.)"

echo
echo "--- 2b) Search for Gatekeeper / Kyverno / similar policy engines that might enforce image provenance ---"
echo "  (These do not guarantee provenance, but they can be part of the implementation.)"
kubectl get ns 2>/dev/null | sed 's/^/  /'
echo
echo "  Checking for common policy-engine namespaces:"
for ns in gatekeeper-system kyverno opa opa-system constraint-system; do
  if kubectl get ns "$ns" >/dev/null 2>&1; then
    echo "  - Found namespace: $ns"
    kubectl get deploy,ds -n "$ns" -o wide | sed 's/^/      /'
  else
    echo "  - Namespace not present: $ns"
  fi
done

echo
echo "=== 3) Inspect cluster-wide pod image usage (to assess reliance on untrusted registries/images) ==="
echo "--- 3a) List unique image registries in use ---"
kubectl get pods -A -o json | jq -r '
  [.items[].spec.containers[].image? // empty,
   .items[].spec.initContainers[].image? // empty] 
  | unique[]
' 2>/dev/null | awk -F/ '
  {
    if (NF==1) { print "docker.io/library (implicit) :: " $0 }
    else if ($1 ~ /.+\..+/) { print $1 " :: " $0 }
    else { print "docker.io :: " $0 }
  }
' | sort -u | sed 's/^/  /'

echo
echo "--- 3b) List pods using images from registries other than an expected trusted domain (edit TRUSTED_DOMAIN) ---"
TRUSTED_DOMAIN="gcr.io"   # CHANGE to your org's trusted registry root, e.g. "gcr.io/my-project" or "us-docker.pkg.dev/your-org"
echo "  Using TRUSTED_DOMAIN=${TRUSTED_DOMAIN} for heuristic check."
echo "  Pods using images NOT starting with this trusted domain:"
kubectl get pods -A -o json | jq -r --arg td "$TRUSTED_DOMAIN" '
  .items[]
  | {
      ns: .metadata.namespace,
      pod: .metadata.name,
      node: .spec.nodeName,
      images: (
        [.spec.containers[].image? // empty,
         .spec.initContainers[].image? // empty] | unique
      )
    }
  | select([.images[] | startswith($td)] | any | not)
  | "ns=\(.ns) pod=\(.pod) node=\(.node) images=\(.images|join(","))"
' 2>/dev/null | sed 's/^/  /'

echo
echo "=== 4) Optional: Look for annotations/labels hinting at image provenance policies ==="
echo "--- 4a) Search namespaces for policy-related labels/annotations ---"
kubectl get ns -o json | jq -r '
  .items[]
  | {
      name: .metadata.name,
      labels: (.metadata.labels // {}),
      ann: (.metadata.annotations // {})
    }
  | select(
      ( [ ( .labels|to_entries[]?.key ), ( .ann|to_entries[]?.key ) ]
        | flatten[]
        | tostring
        | test("imagepolicy|image-policy|provenance|sigstore|cosign|slsa"; "i")
      )
    )
  | "Namespace: \(.name)\n  Labels: \(.labels)\n  Annotations: \(.ann)\n"
' 2>/dev/null || echo "  (No namespaces with obvious image-provenance-related labels/annotations.)"

echo
echo "=== 5) Summary / How to interpret this output ==="
cat <<'EOF'
INTERPRETATION (what indicates a potential problem):

1) No clear ImagePolicyWebhook or equivalent:
   - If section 2a shows no webhook configurations whose names/webhook names suggest image policy
     or provenance, there is likely NO ImagePolicyWebhook-based protection configured.
   - Managed control planes (like GKE) may hide API-server flags, but you should still expect to
     see some webhook or policy engine explicitly guarding image usage if provenance is required.

2) No policy engines enforcing image rules:
   - If section 2b shows NONE of the common policy namespaces (gatekeeper-system, kyverno, etc.),
     and your organization has not documented another mechanism, image provenance is probably NOT
     centrally enforced.

3) Broad use of arbitrary/untrusted registries:
   - In section 3a, many distinct public registries (e.g. docker.io, quay.io) without restriction
     suggests weak control over image sources.
   - In section 3b, a large number of pods listed as "NOT starting with TRUSTED_DOMAIN" indicates
     workloads pulling from outside your intended trusted registry; provenance controls are likely
     incomplete or absent.

4) Lack of policy-related labels/annotations:
   - If section 4a shows no namespaces with labels/annotations referring to image policy,
     provenance, sigstore, cosign, SLSA, etc., there may be no documented, namespace-scoped
     provenance enforcement.

This script does NOT prove compliance or non-compliance by itself. Its output should be
reviewed together with your cluster design and documented security controls to decide whether
ImagePolicyWebhook (or an equivalent mechanism) is configured to enforce image provenance
for all relevant workloads.
EOF