The registry is a security boundary
A pod spec says myapp:latest. Between that string and the container that actually runs, trust has to be decided somewhere. Most clusters decide it by accident, and the accident is the part worth reading about.
The registry is where the decision actually gets made, because it's where the image and its claims live. The cluster just runs what it's told. If you want to control what runs, the control point is upstream, at the registry, and it starts with understanding what a tag actually is.
A tag is a promise. A digest is a fact.
latest is a moving pointer. It's the newest build, and nothing ties
it to a specific version, let alone specific bytes. The same string can resolve to
different images at different times, which is bad enough on one node.
At fleet scale it's worse. Every node pulls independently. One Deployment can
have pod A on node one running the morning build and pod B on node two running the
afternoon build. Same myapp:latest, different bytes, different
behavior, and the spec cannot tell you which version is actually running anywhere.
The string lies. Only the digest tells the truth. Pinning by tag gives you
convenience and a reproducibility hole. Pinning by digest,
myapp@sha256:9f2…, gives you provably the same bytes on every
pull, which is the baseline any trust story needs.
But the digest is not the whole story
Here's where people oversell the digest. It guarantees integrity. These are the bytes that were pushed. It guarantees nothing about provenance or content. A compromised account can push any bytes, and the digest faithfully certifies that yes, those are the bytes. And a digest says nothing about what's inside the layers, the base image, the dependencies, the known vulnerable packages.
So the three questions are separate, and each has its own answer.
- Integrity. Are these the right bytes? The digest answers this.
- Provenance. Who pushed them? The signature answers this, binding an identity to the digest.
- Content. What's inside? The SBOM answers this, binding the ingredient list to the digest as an attestation.
Digest, signature, SBOM. Three different questions, three different answers, and a real supply chain story needs all three.
Where the signature check actually happens
This is the mechanism most people get wrong. The signature is not verified at image pull time, when the kubelet fetches the layers. It's verified at admission, before the pod even exists.
The admission controller, Kyverno or OPA Gatekeeper with cosign, or sigstore's
policy controller, intercepts the pod creation request synchronously. It acts as a
client of the registry, fetching the image manifest and the signature artifact, the
.sig object keyed by digest, or the entry in sigstore's transparency
log for keyless. It verifies the signature against the trusted key, or against a
short lived certificate from Fulcio plus the Rekor log in keyless mode. If it
checks out, the pod proceeds and the kubelet pulls. If not, the request is denied,
synchronously, and the dev sees the error in the apply output.
The admission controller never pulls the image layers. It pulls metadata and signatures. The actual image pull happens later, at the kubelet, after the answer is already yes. Admission decides by querying the registry's artifacts. That's why the registry is a boundary and the cluster is the enforcement point's audience.
What an unsigned image gets you
An unsigned image simply fails verification. The controller finds no signature,
or one that doesn't validate against the trusted key, and the pod creation request
is rejected. No stuck state, no half created pod. The dev sees
admission webhook denied the request and goes back to sign the image.
That's the point. The boundary rejects what it cannot verify.
The boring conclusion
Admission can only reject what it can verify, and without a signature and an SBOM there's nothing to verify. The registry is where that verification happens, and the cluster is where it's enforced. Pin digests, sign images, attach an SBOM, and verify at admission. Then the boundary is real instead of aspirational.
What's the image you stopped trusting the day you checked its SBOM?