Engineer builds open-source reference to enforce Kubernetes supply chain security

A software engineer has released an open-source reference implementation called k8s-secure-supply-chain, highlighting a critical gap in container security: most pipelines scan and sign images but clusters rarely enforce those checks at admission. The project demonstrates that if a cluster allows unsigned or unapproved images to run, pipeline security measures amount to little more than advisory suggestions. Running locally via kind with Argo CD, the setup uses tools like Cosign, Kyverno, Trivy, Syft, and Argo CD to enforce policies such as approved registries, valid signatures, SBOM attestations, pinned tags, and resource limits. A key design principle separates CI from the cluster entirely — the cluster independently verifies evidence left in the registry rather than trusting the pipeline directly. The project also includes a deliberate test using a known-vulnerable image to confirm that the Trivy gate actively rejects unsafe builds rather than silently passing them.