DoD Platform One & Iron Bank Hardened Container Pipeline

1. Overview & DoD Mandate

The Department of Defense Platform One initiative provides authorized infrastructure and container blueprints with a Continuous Authority to Operate (cATO). Iron Bank (registry1.dso.mil) serves as the official DoD repository of hardened, digitally signed containers that have cleared automated static analysis, vulnerability scanning, and DISA STIG container compliance.

This engineering runbook guides teams in configuring continuous automated ingestion, verification, and cluster-level admission enforcement for mission-critical Kubernetes workloads.

2. DevSecOps Container Ingestion Lifecycle

[ DoD Iron Bank ]      [ GitLab / GitHub CI ]     [ Sigstore Cosign ]    [ Kyverno Admission ]
registry1.dso.mil ---> Authenticated Pull    ---> Verify Attestation ---> Cluster Gatekeeper
(Hardened UBI9)        Trivy / Anchore Scan       & Digest Match          Blocks Unsigned Pods

3. Kubernetes Kyverno Zero-Trust Admission Policy

Deploy this cluster-level Kyverno policy to reject any image that has not been cryptographically signed with the official corporate/DoD Cosign key:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: "verify-iron-bank-signatures"
  annotations:
    policies.kyverno.io/title: "Verify DoD Image Signatures"
    policies.kyverno.io/category: "Supply Chain Security"
spec:
  validationFailureAction: Enforce
  webhookTimeoutSeconds: 15
  rules:
    - name: "verify-signature"
      match:
        any:
        - resources:
            kinds:
              - Pod
      verifyImages:
      - imageReferences:
        - "registry.agilefedtech.com/*"
        - "registry1.dso.mil/*"
        attestors:
        - entries:
          - keys:
              publicKeys: |
                -----BEGIN PUBLIC KEY-----
                MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAgileFedTechDefenseDevSecOpsPublicKey...
                -----END PUBLIC KEY-----

4. Hardened Pod Security Context Baseline

All container workloads running across sovereign clusters must conform strictly to the restricted pod security standards:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: "mission-telemetry-engine"
  namespace: "defense-core"
spec:
  replicas: 3
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: "engine"
        image: "registry.agilefedtech.com/ironbank/ubi9-minimal:latest"
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
              - ALL
        volumeMounts:
        - name: "tmp-scratch"
          mountPath: "/tmp"
      volumes:
      - name: "tmp-scratch"
        emptyDir:
          medium: Memory

5. Production Pipeline Verification Checklist

• Cosign Signature Check: Execute cosign verify --key cosign.pub $IMAGE_DIGEST to ensure zero unsigned layers transit staging.
• CVE Delta Threshold: Confirm zero Critical or High CVEs with available upstream patches remain in the image manifest.
• Rootless Container Execution: Inspect runtime logs with kubectl exec -it -- id verifying non-zero UID.
• Audit Trail Storage: Verify that container build SBOMs (Software Bill of Materials) are archived in CycloneDX format for 7 years.