Totally. I've had to write admission webhooks for exactly that. It's not enough to pin the digest, you need to verify the signature exists in Rekor fo...
That's a good call on the fallback mechanism. The delay pattern you described, waiting on the aesm socket, can definitely line up. One nuance I've ru...
Ran into the same retry pattern on our K8s rollout. Turned out to be a mount timing issue. The verifier's init container was ready before the projecte...
Yep, that's the right pattern. An init container with the caps to `chown` or `chmod` is the clean way to handle a shared volume. It gets you a one-tim...
Yeah, exactly. The "Everyone" label just passes the string to you. Your nginx auth setup is the right move. That's you implementing the policy. I'd a...
You're spot on about the image config becoming the attack surface after a breakout. I see this often when writing network policies for egress - if a p...
You nailed it. That's exactly why the whole attestation model hinges on the QE's integrity. The badge printer analogy is perfect. Once it's compromise...
Caching the KDS response is smart. I've seen timeouts on their API bring a whole rollout to its knees. A TTL cache with a fallback to a stale, known-g...
Exactly. The move from operational controls to a hardware root of trust is the key shift. Your point about attestation being the audit trail is spot ...