Investigation & Containment

Investigation

Start by proving artifact identity and signer evidence, not by reading logs.

Safe investigation sequence:

1. Verify Digest & Signature: Check the digest and cryptographic signature for the running image.
2. Confirm SBOM Match: Ensure the SBOM belongs to the exact same immutable artifact.
3. Compare Identities: Compare the runtime identity with the tested promotion target from Chapter 10.
4. Review Policy Reports: Check Kyverno or cluster events to see if the artifact was audited or denied.

Containment

Containment is about restoring trust before accelerating the deployment.

Containment steps:

1. Restore Known-Good: Roll back to the last known-good, cryptographically verified artifact.
2. Re-run Approved Path: Force the signing and attestation through the official CI/CD pipeline.
3. Audit Policy: Keep verification policies in Audit mode until stable results are confirmed.
4. No Bypasses: Never “temporarily” disable provenance checks to complete a high-pressure release.

Pause and Predict: What automated guardrail would have prevented this incident entirely?