Admission webhooks in Kubernetes can be bypassed via static pods, direct kubelet API access, or misconfigured namespace selectors. The Supply Chain NRI Plugin addresses this gap by moving image verification one layer lower — to the container runtime itself — using the Node Resource Interface (NRI), which is supported by both CRI-O and containerd. Every container must pass through the NRI hook synchronously before starting, regardless of how it was scheduled. The plugin verifies three attestation types: SLSA provenance (build integrity), VEX (vulnerability exploitability), and VSA (pre-verified summary attestations that short-circuit redundant checks at scale). Configuration is split into operational settings and per-namespace security policies. Deployment supports Kubernetes DaemonSets, systemd services, or pre-installed binaries. A phased rollout (observe → tighten → enforce) is recommended, with Prometheus metrics and hot-reloaded config. Trade-offs around fail-open vs. fail-closed behavior and circuit breakers are explicitly configurable. Limitations include no air-gapped support yet and node-level compromise remaining out of scope.
Table of contents
The Gap Below the API ServerVerification at the Runtime LevelWhat Gets VerifiedVerification Flow & ResilienceConfiguration: two layers by designTry it outDeploymentA practical rolloutFailure modes and trade-offsWhat’s nextThe bottom line2.2K Impressions1 Comment