Next to what you already run
Three good tools, and the seam between them.
Each of these does one part of this well and is free. None of them carries a scanner, a signature verifier and the record of the decision in one place, which is the part an auditor asks about.
Kyverno
A graduated CNCF policy engine for every resource in the cluster. It verifies image signatures; it has no scanner of its own and no period report.
Side by side
Trivy Operator
The same scanner we run, as reports in the cluster. It finds what is wrong and writes it down; stopping the pod is somebody else's webhook.
Side by side
Sigstore policy-controller
Signature and attestation verification at admission, from the project that defines the format. It answers who signed the image, not what is in it.
Side by side
Install it yourself.
Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.
Create an account