Use when hardening the container image and enforcing supply-chain integrity for a Kubernetes workload after security and operations have decided the image-trust, scanning, and provenance posture. Produces minimal non-root read-only-root-FS images with dropped capabilities, image signing (cosign), SBOM generation (Syft), vulnerability scanning (Trivy/Grype) as a required gate, and admission-control policy (Kyverno/Gatekeeper) enforcing signed-image, non-root, and digest-pinned requirements at the cluster. This is the archetype-scoped successor to the security-context slice of the omnibus. Do not use for base manifest authoring, network/identity policy, autoscaler tuning, observability wiring, the CI pipeline that runs the gate, or cluster provisioning; use the other Family G archetype skills (pipeline wiring is the CI stack; cluster provisioning is out of family).
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Use when hardening the container image and enforcing supply-chain integrity for a Kubernetes workload after security and operations have decided the image-trust, scanning, and provenance posture. Produces minimal non-root read-only-root-FS images with dropped capabilities, image signing (cosign), SBOM generation (Syft), vulnerability scanning (Trivy/Grype) as a required gate, and admission-control policy (Kyverno/Gatekeeper) enforcing signed-image, non-root, and digest-pinned requirements at the cluster. This is the archetype-scoped successor to the security-context slice of the omnibus. Do not use for base manifest authoring, network/identity policy, autoscaler tuning, observability wiring, the CI pipeline that runs the gate, or cluster provisioning; use the other Family G archetype skills (pipeline wiring is the CI stack; cluster provisioning is out of family).
Kubernetes Supply Chain and Image Hardening
When to use
Invoke when hardening a workload's container image, establishing the signing/SBOM/scan gate, or authoring the admission policy that enforces image trust at the cluster — or when auditing an inherited workload running unsigned, root, or unscanned images. This skill owns the hardening and enforcement; the security-context floor was set by the manifest archetype.
Do not use for: base manifest authoring (use k8s-workload-packaging-and-manifest); NetworkPolicy/RBAC and the PSS namespace floor (use k8s-network-and-identity-policy); autoscaler tuning (use k8s-scaling-and-resilience-topology); metrics/log/trace wiring (use k8s-observability-and-operations-readiness); the CI pipeline that executes the scan/sign steps (owned by the github-actions stack — this skill defines the gate and the admission policy, not the workflow); cluster provisioning and control-plane setup (out of Family G — owned by the cloud platform stack and Terraform).
Inputs
Required:
A container image or build from the language packaging sub-skill, and the workload manifest set from k8s-workload-packaging-and-manifest (the security-context floor this skill hardens and the image this skill signs/scans).
Approved architecture/security decisions on image-trust, scanning severity gate, and provenance posture, or explicit confirmation they are intentionally deferred.
Optional:
Approved architecture/operations decisions on the registry, signing-key custody, and attestation storage.
The workload tier from architecture-schema (drives scan-severity gate strictness and signing requirement).
The signing infrastructure (cosign keyless/OIDC vs key-pair) and the SBOM format (SPDX / CycloneDX).
The admission engine in use (Kyverno / Gatekeeper) — consumed; PSS namespace floor is the network archetype's.
The CI system (consumed: this skill defines the gate; the pipeline wiring is the CI stack's ownership).
Operating rules
Never generate tutorial-grade hardening. Assume the image will be attacked: a root container, a writable root FS, a critical CVE, or an unsigned image must all be impossible to deploy.
Consume architecture/security and architecture/operations; do not invent decisions. Image-trust requirements, the scan severity gate, signing-key custody, and provenance posture are decisions made upstream. If a needed decision is missing, pause and raise an ADR candidate rather than guessing.
The image is minimal, non-root, read-only-root-FS, and capability-stripped. Distroless/scratch/minimal base, a non-root UID, readOnlyRootFilesystem, and drop: [ALL] are hard requirements — this skill hardens the floor the manifest archetype set; it does not merely restate it.
Every promoted image is signed. cosign signature (keyless/OIDC preferred per the upstream key-custody decision); an unsigned image cannot be promoted. Signing is on the digest, not a mutable tag.
An SBOM is generated and attached. Syft (or the upstream-named tool) produces an SBOM in the named format, attached/attested to the image digest so the dependency set is auditable post-deploy.
Vulnerability scanning is a required gate, not a report. Trivy/Grype runs and fails the promotion at the upstream-defined severity threshold (tier-correct). A scan whose findings do not block promotion is decoration.
Admission control enforces trust at the cluster, not just in CI. A Kyverno/Gatekeeper policy rejects unsigned images, root containers, mutable-tag images, and missing-digest references at admission — so a bypassed pipeline still cannot deploy an untrusted image. CI gates and admission are defense-in-depth, not either/or.
The admission policy extends the PSS floor; it does not replace it. The pod-security.kubernetes.io/enforce namespace label is the network archetype's; this skill adds the signed-image / digest-pinned / provenance policies PSS does not cover. Name the boundary.
Provenance is attestable. Where the upstream posture requires it, a build provenance attestation (SLSA-style) is produced and verified by the admission policy — not just a signature that proves who signed, but a record of how it was built.
This skill owns image hardening + supply-chain enforcement + the admission policy. Base manifests, network/identity, scaling, observability, and the CI pipeline wiring are named handoffs, not implemented here.
A workload whose admission policy has not been tested with a deliberately bad image (unsigned, root, mutable tag) that is correctly rejected is not done.
Output contract
The generated hardening and enforcement MUST conform to:
security-standards — minimal non-root read-only-root-FS image, dropped capabilities, signed images, SBOM, scan-as-gate, admission enforcement of image trust.
deployment-standards — image signed and scanned before promotion; the gate blocks promotion; enforcement reproducible as policy manifests.
observability-standards — admission rejections and scan-gate failures are observable (collection wiring handed off to the observability archetype).
naming-conventions — policy and attestation object names kebab-case, suffixed by kind when ambiguous.
architecture-schema — tier classification drives scan-severity gate strictness and the signing/provenance requirement.
Upstream contract: architecture/security is the source of truth for image-trust, scan gate, and provenance posture; architecture/operations is the source of truth for registry, key custody, and attestation storage. If a needed decision is missing, pause and raise an ADR candidate. Base manifests, network/identity, scaling, observability, and CI pipeline wiring are named handoffs.
Progressive references
Read references/k8s-supply-chain-playbook.md when hardening any owned area or checking the anti-pattern list.
Read references/k8s-supply-chain-quality-rubric.md before declaring hardening complete.
Use assets/k8s-supply-chain.template.md as the image / signing / SBOM / scan / admission pattern reference.
Process
Gather context: load architecture/security (image-trust, scan severity gate, provenance) and architecture/operations (registry, key custody, attestation storage). Resolve the workload tier from architecture-schema. Confirm the image/build and the manifest security-context floor exist. If a needed decision is missing, raise an ADR candidate before proceeding.
Harden the image: minimal base (distroless/scratch/minimal), explicit non-root UID, readOnlyRootFilesystem, drop: [ALL] capabilities, no shell/package-manager in the runtime layer where avoidable; reconcile with the manifest archetype's floor (harden, do not just restate).
Configure signing: cosign signing on the image digest using the upstream key-custody path (keyless/OIDC preferred); verification configuration for the admission policy.
Generate the SBOM: Syft (or upstream-named) in the named format (SPDX/CycloneDX), attached/attested to the digest.
Configure the vulnerability-scan gate: Trivy/Grype at the tier-correct severity threshold from architecture/security, defined to fail promotion (the gate definition — the pipeline that runs it is the CI stack's handoff).
Author the admission policy: Kyverno/Gatekeeper rules rejecting unsigned images, root containers, mutable-tag/non-digest references, and (where required) missing provenance — extending, not replacing, the PSS namespace floor.
Configure provenance where required: a build attestation (SLSA-style) produced and verified by the admission policy.
Verify: deploy a deliberately bad image (unsigned, then root, then mutable-tag) and confirm the admission policy rejects each; confirm a known-CVE image fails the scan gate; document any check that cannot run in the environment.
Emit the hardening + policy under k8s/security/ plus supply-chain.md (image posture, signing/SBOM/scan gate, admission policy matrix, provenance) and the named handoff list. Validate against security-, deployment-, observability-standards, naming-conventions, and architecture-schema. Revise until all pass or the gap is documented.
Build-provenance attestation where the upstream posture requires it.
supply-chain.md (image posture, gate, admission matrix, provenance) and the named handoff list.
Output rules:
Functional, enforceable policy and image spec — not placeholder.
An unsigned, root, or unscanned image cannot be promoted or admitted.
The admission policy extends the PSS floor; it does not duplicate or replace the network archetype's namespace label.
Base manifests, network/identity, scaling, observability, and CI pipeline wiring are handoffs, not implemented here.
Quality checks
The image uses a minimal base, a non-root UID, readOnlyRootFilesystem, and drop: [ALL] — hardened beyond the manifest archetype's floor.
Every promoted image is cosign-signed on the digest via the upstream key-custody path; unsigned images cannot be promoted.
An SBOM is generated in the named format and attached/attested to the image digest.
A vulnerability scan runs at the tier-correct severity threshold and fails promotion on breach (gate, not report).
An admission policy rejects unsigned images, root containers, and mutable-tag/non-digest references at the cluster.
The admission policy extends the PSS namespace floor (owned by k8s-network-and-identity-policy) — it does not duplicate or replace it.
Build provenance is produced and admission-verified where the upstream posture requires it.
A deliberately bad image (unsigned / root / mutable-tag) is correctly rejected by admission, and a known-CVE image fails the scan gate, or the gap is documented.
supply-chain.md documents image posture, the gate, the admission matrix, and provenance; base manifest/network/scaling/observability/CI-pipeline are named handoffs.
