# Kubernetes
All Kubernetes notes →1 — Image Security
Why minimal or distroless base images shrink the attack surface far more than patching CVEs in a bloated one ever will.
2 — Image Signing
A signature only proves who built the image, not that it's safe — signing and scanning solve different problems and neither substitutes for the other.
3 — Sigstore & Cosign
Keyless signing binds an image to an OIDC identity and a public transparency log instead of a long-lived private key that can leak or expire.
4 — SBOM
An SBOM turns 'are we affected by this CVE' from a multi-day manual audit into a single query against a manifest already generated at build time.
5 — Vulnerability Scanning
Scanning only at build time catches CVEs known when the image shipped — rescanning at admission and runtime is what catches the ones disclosed afterward.
6 — Trusted Registries
A registry allowlist enforced at the admission layer is what actually stops an untrusted image from running — scanning alone only warns, it doesn't block.
7 — Policy Enforcement (OPA Gatekeeper, Kyverno)
Kyverno's native Kubernetes-resource policies trade Rego's expressiveness for a much shorter path from 'write policy' to 'policy enforced'.
8 — Software Supply Chain Security
Most real-world breaches like SolarWinds and xz-utils compromised the build pipeline itself, not the shipped artifact — securing the artifact after the fact is too late.
9 — SLSA Framework
SLSA's levels grade the provenance of the build process, not the code's security — a perfectly secure app built on an untrusted pipeline still fails the bar.