Kyverno: CNCF Policy Engine

The gate is on the attestation, not the digest, and it only applies when a pod is created. I created a Kyverno policy that looks at the cosign-vuln attestation (the signed Trivy vulnerability report) attached to the image's digest and requires its scanFinishedOn to be within the threshold, which I ended up setting to 720h, so 30 days. It runs at admission only, so a Job that's already running is never re-evaluated. It gets checked again at the next pod creation, so a retry, a CronJob run, a rollout, or a reschedule. Pinned golden digests don't age out, because the pipeline that refreshes those images re-attests on every scheduled run. It rescans and runs cosign attest against the published digest nightly or weekly, depending on the tier the image is in, even when the bytes haven't changed. A copa-patched image is the other case. It typically gets a new digest each run, and the old digest ages out after 30 days. That's the intended outcome, because the old digest is the unpatched one.