Generate Kyverno Image Signature Policies

API endpoint

Call /api/v1/policies/kyverno/generate/image-signature with an admin token. The response returns a full Kyverno ClusterPolicy manifest.

Request example

{
  "policy_name": "tenant-signature-policy",
  "validation_failure_action": "Enforce",
  "image_references": ["ghcr.io/acme/*"],
  "excluded_namespaces": ["kube-system"],
  "rekor_url": "https://rekor.sigstore.dev"
}

Operational notes

• Use Audit mode first to observe violations without blocking workloads.
• Promote to Enforce after validation in non-production namespaces.
• Use cosign_public_key for pinned-key verification or omit it for keyless mode.
• Keep excluded namespaces minimal to preserve policy coverage.