Supply Chain Security
Supply chain security covers the path from source to running container: image provenance, scanning, signing, and admission. Understand that a tag is mutable and a digest is immutable; pinning images by digest (image@sha256:...) is the strongest reference. Use imagePullPolicy: Always for mutable tags, and prefer minimal base images to shrink CVE surface. Scan images in CI with tools such as Trivy or Grype and treat results as gates rather than reports.
Signing and verification: cosign signs an image and stores the signature in the registry; cosign verify checks it against a public key or a keyless identity. Enforce at admission with a policy engine such as OPA Gatekeeper, Kyverno, or a ValidatingAdmissionPolicy so unsigned or unscanned images are rejected. Also know SBOM generation with syft and static manifest analysis with kubesec or kube-linter.
Traps: assuming admission controllers verify signatures by default (they do not); forgetting signatures cover the digest, so retagging breaks verification; and treating imagePullSecrets as a security control when they only authenticate pulls.
Worked example: reference registry.example.com/app@sha256:<digest> in the Deployment with imagePullPolicy: IfNotPresent, and add a Kyverno verifyImages rule requiring a cosign signature from your CI identity.