Attestkeep 1.0 is out, and the comment thread is in the changelog

Attestkeep 1.0 has been released, with its comment thread now included in the changelog. The tool is a validating admission webhook for Kubernetes, which reviews pod CREATE and UPDATE events against a policy. This includes checks such as the :latest tag, registry allow-list, digest pinning, vulnerability thresholds, cosign signatures, attestations, and fifteen workload hardening checks. The policy's decision is recorded in a ledger, which can be signed into a package of evidence.

Recent comments by Vinh Nguyen and Tobias prompted updates to Attestkeep 1.0. Vinh pointed out the need for a second component to the ledger, which handles admission decisions for running containers that have no admission event. He also highlighted a destructive case where a manually applied pod has no controller, leading to the pod being closed and the finding being deleted.

Tobias questioned whether the absence of findings should be recorded as evidence, to which the answer is that the operator verifies its own webhook endpoint against the CA bundle and records any windows of failure as part of the evidence package.

Two significant features in Attestkeep 1.0 are admissionTiming and failurePolicy. admissionTiming determines how the scanner fills a cache in the background before the API server waits to process the admission event. failurePolicy allows the operator to choose whether to allow pods to run while the webhook is unreachable or to immediately deny admission. These decisions are now clearly recorded in the evidence package, emphasizing that the choice is up to the operator and their consequences are documented.