# Cluster khud signature check karta hai. Pipeline bhi karti hai, par wo bypass
# ho sakti hai - ye nahi. Bina cosign signature wali image pod ban hi nahi sakti.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
  annotations:
    policies.kyverno.io/description: >-
      Private registry se aane wali har image cosign se signed honi chahiye.
spec:
  background: false
  webhookConfiguration:
    failurePolicy: Fail
  rules:
    - name: check-cosign-signature
      match:
        any:
          - resources:
              kinds: [Pod]
              namespaces: ["demo-app", "hello-api"]
      verifyImages:
        - imageReferences:
            - "ns31240276.ip-51-195-4.eu:5000/*"
          failureAction: Enforce
          # digest par rewrite nahi karte - warna ArgoCD ko drift lagta hai
          # aur selfHeal se khaamakhaan ladai hoti hai.
          mutateDigest: false
          verifyDigest: false
          required: true
          attestors:
            - count: 1
              entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEO+rCXEKByVGTiB+2zDA4gr495oib
                      zNMItTZ+s4xYETg4ZoTOJTCxo83uAPDrD8xesWp1ttWYUbR6xcq2g7kagw==
                      -----END PUBLIC KEY-----
                    # tlog upload band hai (private registry), verify bhi offline
                    ctlog:
                      ignoreSCT: true
                    rekor:
                      ignoreTlog: true