kevgate-admit

Vulnerability scans usually run in a pipeline, and nothing stops a workload with a known-exploited vulnerability from reaching the cluster anyway. A tag is also not evidence: nginx:1.25 can point at different bytes tomorrow, so a report about a tag says little about what a node will pull.

For CREATE and UPDATE of Pods, Deployments, StatefulSets, DaemonSets, Jobs and CronJobs, it extracts every container, init container and ephemeral container image, parses each reference strictly, looks up a Trivy report for each image digest, optionally checks the report's signature, scores each finding, and applies the namespace's policy. The answer is allow, allow with warnings, or deny with a message naming the rule and the top findings.

Policy is per namespace: denyKev, maxRisk, requireDigest, requireEvidence, requireSignedEvidence, allowed registries, exceptions with an expiry date, and an audit mode that admits but warns. It does not scan images itself; it enforces over reports a scan pipeline already produced.

The Go score must equal the Python score

Two services that rank the same finding differently would be a bug nobody notices until an argument about a denial. Go can differ from Python in the last bit: constant expressions are evaluated with arbitrary precision, and the compiler may fuse multiply-adds on some architectures. internal/risk keeps the weights in variables so the arithmetic runs in float64 at run time, forces explicit conversions to prevent fusing, and rounds to one decimal through the decimal expansion of the value, which is what Python's round(x, 1) does. scripts/gen_parity.py calls kevgate's own risk_score to generate 1000 reference vectors (a grid plus a seeded random sample) and a test compares every one, next to 12 hand-computed cases.

Only a well-formed digest names an image

internal/imageref never resolves a tag, and it parses a reference under the OCI distribution grammar before anything else uses it: dot segments, upper-case repositories, bad hosts, bad ports and non-ASCII bytes are rejected as imageRef, and allow-list entries are validated with the same rules and match whole path components. A malformed digest is an error rather than "unpinned", so an image that cannot be pulled is not confused with one that merely lacks a pin. Evidence is keyed by sha256-<hex>.json, and a report whose own metadata names a different digest is rejected as an evidence error, so a file renamed to another image's digest cannot vouch for it.

Bounded work and last-good state

Admission sits on the critical path of every deploy, so the lookup is bounded. Each request has a time budget (8 s by default, to stay under the webhook timeout), each evidence lookup has its own (3 s), a semaphore caps concurrent lookups, a request may name at most 128 distinct images, and report files and HTTP bodies have size caps. If the evidence source fails, --fail-mode closed (the default) denies instead of waiting. Policy, KEV catalog, EPSS data and the TLS pair are hot reloaded by a generic File[T] that swaps a parsed copy atomically; a file that fails to parse never replaces the last good one, and a broken version is remembered by modification time and size so it is reported once per change, not on every tick.

A signature binds a report to its digest

internal/evsign signs a domain-separation string, the image digest and the report bytes together, with Ed25519 or ECDSA P-256 from the standard library and a detached .sig file. Moving a signed report to another digest, or editing it, breaks verification. The directory provider reads the report once and uses the same bytes for the signature check and the parse, so what was verified is what is judged. A report that fails the check is not scored: it counts as missing, and requireEvidence decides.