Configure Image Provenance Using ImagePolicyWebhook Admission Controller

# 1) Check if any ImagePolicyWebhook configuration exists
# Run on: any machine with kubectl access

kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations \
  -o wide

# 2) Inspect likely image-policy related ValidatingWebhookConfiguration(s)

# Adjust the name(s) based on the output of the previous command
kubectl get validatingwebhookconfigurations <webhook-name> -o yaml

# 3) Check if any MutatingWebhookConfiguration is being used for image policy
kubectl get mutatingwebhookconfigurations -o yaml

# 4) Discover and inspect policy engine components (if any)
# Common namespaces; adapt or add your org’s namespaces as needed
kubectl get pods -A | egrep -i 'image|policy|cosign|notary|kyverno|connaisseur|gatekeeper'

# Example: inspect a policy engine namespace
kubectl get all -n <policy-namespace>
kubectl describe deployment <policy-deployment> -n <policy-namespace>
kubectl get configmap,secret -n <policy-namespace> -o wide

# 5) Exercise the current configuration with a test pod
# Replace <untrusted/image:tag> and <trusted/image@sha256:...> with images appropriate for your environment

# Test A: attempt to create a pod using an image that should FAIL provenance checks
kubectl apply -f - << 'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: image-provenance-test-untrusted
spec:
  containers:
  - name: test
    image: untrusted/image:tag
    command: ["sleep", "3600"]
  restartPolicy: Never
EOF

# Test B: attempt to create a pod using an image that should PASS provenance checks
kubectl apply -f - << 'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: image-provenance-test-trusted
spec:
  containers:
  - name: test
    image: trusted/image@sha256:deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef
    command: ["sleep", "3600"]
  restartPolicy: Never
EOF

# Check results
kubectl get pods image-provenance-test-untrusted image-provenance-test-trusted
kubectl describe pod image-provenance-test-untrusted
kubectl describe pod image-provenance-test-trusted

# 6) Check API server flags for admission webhooks (if accessible via config in-cluster)
# Some managed clusters expose a ConfigMap or API object with apiserver flags.
# Example (adapt as needed):
kubectl get pods -n kube-system -l component=kube-apiserver -o yaml

#!/usr/bin/env bash
#
# audit-image-policy-webhook.sh
#
# Purpose:
#   Report whether ImagePolicyWebhook-based image provenance is configured
#   and enforced across the cluster.
#
# Run on:
#   Any machine with kubectl access and correct kubeconfig context.
#
# Requirements:
#   - bash
#   - kubectl in PATH
#   - cluster-admin or equivalent access (to list webhooks, namespaces, and workloads)

set -euo pipefail

echo "=== Image Provenance / ImagePolicyWebhook Cluster Audit ==="
echo "Kubeconfig context: $(kubectl config current-context)"
echo

###############################################################################
# 1. Check for presence of ImagePolicyWebhook admission configuration object
###############################################################################
echo "1) AdmissionConfiguration objects that may define ImagePolicyWebhook:"
kubectl get cm -A \
  --field-selector metadata.name=admission-configuration \
  -o wide 2>/dev/null || true
echo

echo "   Attempting to locate AdmissionConfiguration in kube-system namespace:"
ADMISSION_CM_NAME=$(kubectl -n kube-system get cm \
  --no-headers 2>/dev/null | awk '/admission/{print $1}' || true)

if [ -n "${ADMISSION_CM_NAME:-}" ]; then
  echo "   Found potential AdmissionConfiguration ConfigMap(s) in kube-system:"
  kubectl -n kube-system get cm "${ADMISSION_CM_NAME}" -o yaml
else
  echo "   No obvious AdmissionConfiguration ConfigMap found in kube-system."
fi
echo

###############################################################################
# 2. Check for Mutating/ValidatingWebhookConfiguration that enforce image policy
###############################################################################
echo "2) ValidatingWebhookConfiguration objects related to image policy:"
kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io \
  -o custom-columns=NAME:.metadata.name \
  --no-headers 2>/dev/null | grep -i "image\|policy" || echo "   (none matching 'image' or 'policy' in name)"
echo

echo "   Full list of ValidatingWebhookConfiguration objects (for manual review):"
kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io -o wide || true
echo

echo "   Details for likely image-policy related webhooks:"
for w in $(kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io \
              -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' 2>/dev/null \
            | grep -i "image\|policy" || true); do
  echo "----- ValidatingWebhookConfiguration: $w -----"
  kubectl get validatingwebhookconfigurations.admissionregistration.k8s.io "$w" -o yaml
  echo
done

echo "2b) MutatingWebhookConfiguration objects related to image policy (less common):"
kubectl get mutatingwebhookconfigurations.admissionregistration.k8s.io \
  -o custom-columns=NAME:.metadata.name \
  --no-headers 2>/dev/null | grep -i "image\|policy" || echo "   (none matching 'image' or 'policy' in name)"
echo

###############################################################################
# 3. Check for per-namespace admission configuration hints/annotations
###############################################################################
echo "3) Namespaces with annotations that may indicate image policy enforcement:"
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.annotations}{"\n"}{end}' \
  2>/dev/null | grep -Ei 'image|policy|admission' || echo "   (no matching annotations found)"
echo

###############################################################################
# 4. Inventory workloads and their image registries (for provenance review)
###############################################################################
echo "4) Workloads and container images per namespace:"
echo "   NOTE: This does NOT prove image provenance is enforced; it supports review."

namespaces=$(kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')
for ns in $namespaces; do
  echo "----- Namespace: $ns -----"
  kubectl get pods -n "$ns" -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{range .spec.containers[*]}{.image}{" "}{end}{"\n"}{end}' 2>/dev/null \
    || echo "   (no pods or access denied)"
  echo
done

###############################################################################
# 5. High-level summary hints
###############################################################################
echo "=== Interpretation Guide (manual review required) ==="
cat <<'EOF'
This script does NOT determine compliance automatically. Use these indicators:

1) ImagePolicyWebhook configuration:
   - Problem indicators:
     * No AdmissionConfiguration object referencing 'ImagePolicyWebhook' or an
       external image policy service.
     * No cluster-wide documentation/config in ConfigMap or kube-apiserver
       flags describing ImagePolicyWebhook.
   - Healthy indicators:
     * AdmissionConfiguration (via ConfigMap or kube-apiserver config file)
       defines an 'imagePolicy' or 'pluginConfig' entry of type
       'ImagePolicyWebhook' with a reachable backend (e.g., HTTPS endpoint).

2) Webhook configurations:
   - Problem indicators:
     * No ValidatingWebhookConfiguration whose name, rules, or clientConfig
       clearly correspond to an image policy / provenance service.
     * Webhook exists but:
       - 'failurePolicy' is 'Ignore' (weak enforcement).
       - 'namespaceSelector' or 'objectSelector' excludes critical workloads.
       - 'rules' do NOT include create/update of core workload types
         (pods, deployments, statefulsets, daemonsets, jobs, cronjobs).
   - Healthy indicators:
     * A ValidatingWebhookConfiguration that:
       - Targets pod and workload creation/updates in relevant API groups.
       - Uses 'failurePolicy: Fail' for enforcement (as appropriate).
       - Points to a trusted image policy service.

3) Workload images:
   - Problem indicators:
     * Workloads pulling from untrusted or public registries without a clear
       corresponding image policy configuration.
   - Healthy indicators:
     * Images consistently sourced from approved registries, with a clearly
       documented policy on how provenance is validated by the webhook.

Next steps:
   - If you do not find any clear ImagePolicyWebhook or equivalent admission
     webhook enforcing image provenance, treat this as a gap and design a
     policy and webhook deployment following Kubernetes documentation.
EOF