CNCF Proposes Moving Kubernetes Image Verification to Container Runtime Layer

A CNCF post published on July 30 proposes shifting container image signature and attestation checks from Kubernetes admission webhooks down to the container runtime itself, using a Node Resource Interface plugin. The Supply Chain NRI Plugin intercepts CreateContainer events in CRI-O or containerd, verifying SLSA provenance, VEX documents, and VSA attestations against namespace policies before any container starts. This approach addresses four known bypass paths in admission webhooks, including static pods that skip admission entirely, direct kubelet access, misconfigured namespace selectors, and webhook outages that force a choice between cluster lockdown or silent bypass. Unlike admission-layer tools such as Kyverno or OPA Gatekeeper, runtime-level checks apply to every container regardless of how it was scheduled. However, the approach introduces new reliability concerns, as the plugin must be healthy on every node with registry access on each container creation call, and the post does not clarify behavior when the registry is unreachable.