Kyverno Vulnerability Attestation

policy.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-vulnerabilities
spec:
  validationFailureAction: enforce
  webhookTimeoutSeconds: 10
  failurePolicy: Fail
  rules:
    - name: no-critical-vuln
      match:
        any:
        - resources:
            kinds:
              - Pod
      verifyImages:
      - imageReferences:
        - "*"
        attestors:
        - entries:
          - keyless:
              subject: "knqyf263@gmail.com"
              issuer: "https://github.com/login/oauth"
        attestations:
        - predicateType: cosign.sigstore.dev/attestation/vuln/v1
          conditions:
            - all: 
              - key: "{{scanner.uri}}"
                operator: Equals
                value: "pkg:github/aquasecurity/trivy@*"
              - key: "{{scanner.result.Results[].Vulnerabilities[].Severity | (contains(@, 'HIGH') || contains(@, 'CRITICAL'))}}"
                operator: Equals
                value: false

$ trivy image --format cosign-vuln --output vuln.json knqyf263/cosign-test
$ COSIGN_EXPERIMENTAL=1 cosign attest --type vuln --predicate vuln.json knqyf263/cosign-test

https://aquasecurity.github.io/trivy/dev/docs/attestation/vuln/

NOTE: keyless.subject and keyless.issuer should be updated accordingly.

Looks like this capability only in main currently.

Yes, it will be included in the next release.
https://github.com/aquasecurity/trivy/milestone/8