docs(security): the C-0237 exception says there is no admission-layer signature enforcement #4085

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

k8s/bases/infrastructure/cluster-security-exceptions/image-verification.yaml justifies exempting Kubescape control C-0237 cluster-wide in two places, a comment and the exception's reason field. Both say there "is no admission-layer signature enforcement".

That is no longer true for first-party images. k8s/bases/infrastructure/cluster-policies/best-practices/verify-app-images.yaml is a Kyverno ImageValidatingPolicy with failurePolicy: Fail and validationActions: [Deny]. It rejects ghcr.io/devantler-tech/* images at admission unless one of the six keyless cosign identities signed them.

The exception is still needed, because third-party chart images are neither all signed nor checked at admission. Only its stated reason is out of date.

Why it matters

Security exceptions are meant to be reviewed and pruned. A reviewer who reads the current text could conclude that nothing checks signatures at admission, and either weaken the Kyverno policy as redundant or miss that first-party images are already covered.

Acceptance criteria

• The comment and the reason field say that first-party images are verified at admission (Kyverno), at pull (Talos ImageVerificationConfig) and at the Flux OCI source, and that the exception remains because third-party images are neither all signed nor checked at admission.
• No change to the exception's scope or to any policy.

Size: XS.