Software supply chain attacks surged 742% over three years. Here is how to add SBOM generation and dependency scanning to your CI/CD pipeline before a compromised package ships to production.
Use Trivy's .trivyignore file to suppress specific CVE IDs with documented justification, or filter by fixed-only vulnerabilities using the --ignore-unfixed flag. For base image CVEs with no upstream fix, add a time-boxed exception in your security policy and monitor the NVD feed for patch availability rather than blocking all CI builds indefinitely.
Deploy Kyverno or OPA Gatekeeper with a policy that calls Cosign verify against your public key for every image in a Pod spec. Configure the admission webhook in fail-closed mode so images without a valid Cosign signature and attached SBOM attestation are rejected before the kubelet pulls them. Store signing keys in AWS KMS or HashiCorp Vault rather than as Kubernetes Secrets.
Discussion0