kyverno-policy.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-venafi     
spec:
  validationFailureAction: Enforce
  failurePolicy: Fail
  webhookTimeoutSeconds: 30
  schemaValidation: false
  rules:
  - name: call-venafi-signer-extension
    match:
      any:
      - resources:
          namespaces:
          - test-venafi
          kinds:
          - Pod
          operations:
            - CREATE
            - UPDATE
    context:
    - name: tlscerts
      apiCall:
        urlPath: "/api/v1/namespaces/kyverno-notation-venafi/secrets/svc.kyverno-notation-venafi.svc.tls-pair"
        jmesPath: "base64_decode( data.\"tls.crt\" )"
    - name: response
      apiCall:
        method: POST
        data:
        - key: images
          value: "{{images}}"
        - key: trustPolicy
          value: "tp-venafi-test-notation"
        - key: metadata
          value: "{{ request.object.metadata.annotations.\"kyverno-notation-venafi.io/verify-images\" || '' }}"
        - key: attestations
          value: 
          - imageReference: "*"
            type: 
            - name: sbom/example
              conditions:
                all:
                - key: \{{components[?name=='busybox'].version}}
                  operator: AllIn
                  value: [ "3.17", "1.36.1-r2"]
                  message: unsupported busybox version
        service:
          url: https://svc.kyverno-notation-venafi/checkimages
          caBundle: '{{ tlscerts }}'
    mutate:
      foreach:
      - list: "response.results"
        patchesJson6902: |-
            - path: '{{ element.path }}'
              op: '{{ element.op }}'
              value: '{{ element.value }}'

# SIGNED IMAGE: ghcr.io/nirmata/kyverno-notation-venafi-demo:signed
# UNSIGNED IMAGE: ghcr.io/nirmata/kyverno-notation-venafi-demo:unsigned
# SBOM LAYER: ghcr.io/nirmata/kyverno-notation-venafi-demo:signed@sha256:4beaa3137602bf1a256355a1b7f0bd49b9079ea5041d249ce6362142c0fd031a