adding cosign signed image policy to maintain supply chain security in Tekton

tekton/verify-tekton-image-cosign-signed/.chainsaw-test/resource.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: signed-pod
+spec:
+  containers:
+    - name: signed-container
+      image: index.docker.io/arunvel1988/signedimage:latest  # Assumes this is a signed image
+
+---
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: unsigned-pod
+spec:
+  containers:
+    - name: unsigned-container
+      image: index.docker.io/arunvel1988/unsignedimage:latest  # This is an unsigned image

tekton/verify-tekton-image-cosign-signed/.chainsaw-test/test.yaml

@@ -0,0 +1,21 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: require-signed-images-registry
+policies:
+  - ../verify-tekton-image-cosign-signed.yaml
+resources:
+  - resource.yaml
+results:
+  - kind: Pod
+    policy: require-signed-images-registry
+    resources:
+      - unsigned-pod
+    result: fail
+    rule: check-signature
+  - kind: Pod
+    policy: require-signed-images-registry
+    resources:
+      - signed-pod
+    result: pass
+    rule: check-signature

tekton/verify-tekton-image-cosign-signed/artifacthub-pkg.yaml

@@ -0,0 +1,9 @@
+name: verify-tekton-image-cosign-signed
+version: 1.0.0
+displayName: Verify Tekton Image with Cosign
+createdAt: "2023-04-10T23:23:45.000Z"
+description: >-
+  Enforces that all Tekton TaskRun container images are signed using Cosign.
+install: |-
+  ```shell
+  kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/tekton/verify-tekton-image-cosign-signed/verify-tekton-image-cosign-signed.yaml

tekton/verify-tekton-image-cosign-signed/verify-tekton-image-cosign-signed.yaml

@@ -0,0 +1,27 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-signed-images-registry
+   annotations:
+    policies.kyverno.io/title: Require Cosign Signed Image to maintain supply chain security
+    policies.kyverno.io/category: Tekton
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: TaskRun
+    kyverno.io/kyverno-version: 1.7.2
+    policies.kyverno.io/minversion: 1.7.0
+    kyverno.io/kubernetes-version: "1.23"
+    policies.kyverno.io/description: >-
+      A signed image is required to maintain supply chain security
+spec:
+  validationFailureAction: Enforce
+  background: true
+  rules:
+    - name: check-signature
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - image: "index.docker.io/arunvel1988/*"
+          key: "k8s://kyverno/cosign-key-secret"