Merge pull request #233 from kerberos-io/feat/hub-kyverno-all-images

feat(hub): Kyverno signature policies for every UUG.AI image (0.180.0)
2026-11-10 21:10:24 +00:00 · 2026-11-10 22:08:18 +01:00 · 2026-11-10 21:02:56 +00:00
23 changed files with 1135 additions and 11 deletions
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.179.1
+version: 0.180.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -351,11 +351,44 @@ creates Kyverno policies in the release namespace. Without Kyverno (no
 `kyverno.io/v1` API), nothing is created even when enabled.

 Each policy is a plain, namespaced Kyverno `Policy` in its own file in
-`templates/kyverno/`, so it applies only to the release namespace:
+`templates/kyverno/`, so it applies only to the release namespace. There is one
+per `ghcr.io/uug-ai` image the chart can deploy; each requires the image to be
+signed for its own `uug-ai/<image>` repository. "Mode" is the
+`validationFailureAction` the policy uses:

-| Template | Checks |
-|---|---|
-| `hub-api-signed-images.yaml` | `ghcr.io/uug-ai/hub-api` signed for `uug-ai/hub-api` |
+| Template | Image | Releases signed | Mode |
+|---|---|---|---|
+| `hub-api-signed-images.yaml` | `ghcr.io/uug-ai/hub-api` | ✅ signed | value |
+| `hub-cleanup-signed-images.yaml` | `ghcr.io/uug-ai/hub-cleanup` | ✅ signed | value |
+| `hub-frontend-signed-images.yaml` | `ghcr.io/uug-ai/hub-frontend` | ✅ signed | value |
+| `hub-loitering-signed-images.yaml` | `ghcr.io/uug-ai/hub-loitering` | ✅ signed | value |
+| `hub-monitor-device-signed-images.yaml` | `ghcr.io/uug-ai/hub-monitor-device` | ✅ signed | value |
+| `hub-workflows-signed-images.yaml` | `ghcr.io/uug-ai/hub-workflows` | ✅ signed | value |
+| `hub-pipeline-analysis-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-analysis` | ✅ signed | value |
+| `hub-pipeline-counting-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-counting` | ✅ signed | value |
+| `hub-pipeline-monitor-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-monitor` | ✅ signed | value |
+| `hub-pipeline-sequence-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sequence` | ✅ signed | value |
+| `hub-pipeline-throttler-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-throttler` | ✅ signed | value |
+| `hub-audit-signed-images.yaml` | `ghcr.io/uug-ai/hub-audit` | ❌ not yet | always `Audit` |
+| `hub-objecttracking-signed-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` | ❌ not yet | always `Audit` |
+| `hub-vlm-signed-images.yaml` | `ghcr.io/uug-ai/hub-vlm` | ❌ not yet | always `Audit` |
+| `hub-pipeline-dominantcolors-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` | ❌ not yet | always `Audit` |
+| `hub-pipeline-event-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` | ❌ not yet | always `Audit` |
+| `hub-pipeline-export-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` | ❌ not yet | always `Audit` |
+| `hub-pipeline-notification-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` | ❌ not yet | always `Audit` |
+| `hub-pipeline-notification-test-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` | ❌ not yet | always `Audit` |
+| `hub-pipeline-sprite-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` | ❌ not yet | always `Audit` |
+| `hub-pipeline-thumbnail-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` | ❌ not yet | always `Audit` |
+
+Images whose releases are not signed yet stay in `Audit` even when
+`imageVerification.validationFailureAction` is `Enforce`, so enabling
+`Enforce` never blocks them. Their repositories need `sign: true` (and
+`id-token: write`) in their release workflow; once their releases are signed,
+the policy file switches to the configured value in a chart release.
+
+Not covered: `uugai/admin`, `uugai/hub-proxy` and
+`uugai/hub-reactivatesubscriptions` are pulled from Docker Hub rather than the
+signed `ghcr.io/uug-ai` releases, and `oauth2-proxy` is a third-party image.

 To change a policy, edit its file. To add an image, copy a policy file and
 change the image and repository.
@@ -371,9 +404,9 @@ image only when its signature was:
  The release workflow is shared by all UUG.AI repositories, so this repository
  claim is what stops an image of one repository passing as another.

-Today only `hub-api` has a policy; other images get one as their releases start
-signing. `hub-api` releases are signed from `v1.11.39` onwards (and `v1.11.37`);
-in `Enforce` mode an unsigned version such as `v1.11.38` is rejected.
+Signed means the image's releases are signed now; older tags of the same image
+can still be unsigned (for example `hub-api` `v1.11.38`) and are rejected in
+`Enforce`. Check the tags you run before enforcing.

 By default the policies run in **`Audit`** mode: unsigned images are reported in
 Kyverno PolicyReports (for example in Policy Reporter) but still run. Once the
@@ -0,0 +1,56 @@
+{{- /*
+hub-audit images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-audit.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-audit-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-audit images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-audit releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-audit
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-audit:*"
+            - "ghcr.io/uug-ai/hub-audit@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-audit's own repository.
+                      githubWorkflowRepository: uug-ai/hub-audit
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-cleanup images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-cleanup.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-cleanup-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-cleanup images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-cleanup pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-cleanup
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-cleanup:*"
+            - "ghcr.io/uug-ai/hub-cleanup@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-cleanup's own repository.
+                      githubWorkflowRepository: uug-ai/hub-cleanup
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-frontend images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-frontend.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-frontend-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-frontend images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-frontend pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-frontend
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-frontend:*"
+            - "ghcr.io/uug-ai/hub-frontend@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-frontend's own repository.
+                      githubWorkflowRepository: uug-ai/hub-frontend
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-loitering images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-loitering.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-loitering-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-loitering images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-loitering pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-loitering
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-loitering:*"
+            - "ghcr.io/uug-ai/hub-loitering@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-loitering's own repository.
+                      githubWorkflowRepository: uug-ai/hub-loitering
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-monitor-device images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-monitor-device.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-monitor-device-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-monitor-device images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-monitor-device pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-monitor-device
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-monitor-device:*"
+            - "ghcr.io/uug-ai/hub-monitor-device@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-monitor-device's own repository.
+                      githubWorkflowRepository: uug-ai/hub-monitor-device
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-objecttracking images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-objecttracking.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-objecttracking-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-objecttracking images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-objecttracking releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-objecttracking pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-objecttracking
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-objecttracking:*"
+            - "ghcr.io/uug-ai/hub-objecttracking@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-objecttracking's own repository.
+                      githubWorkflowRepository: uug-ai/hub-objecttracking
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-pipeline-analysis images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-analysis.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-analysis-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-analysis images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-analysis pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-analysis
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-analysis:*"
+            - "ghcr.io/uug-ai/hub-pipeline-analysis@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-analysis's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-analysis
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-pipeline-counting images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-counting.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-counting-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-counting images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-counting pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-counting
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-counting:*"
+            - "ghcr.io/uug-ai/hub-pipeline-counting@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-counting's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-counting
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-pipeline-dominantcolors images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-dominantcolors.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-dominantcolors-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-dominantcolors images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-pipeline-dominantcolors releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-dominantcolors pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-dominantcolors
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-dominantcolors:*"
+            - "ghcr.io/uug-ai/hub-pipeline-dominantcolors@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-dominantcolors's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-dominantcolors
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-pipeline-event images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-event.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-event-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-event images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-pipeline-event releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-event pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-event
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-event:*"
+            - "ghcr.io/uug-ai/hub-pipeline-event@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-event's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-event
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-pipeline-export images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-export.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-export-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-export images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-pipeline-export releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-export pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-export
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-export:*"
+            - "ghcr.io/uug-ai/hub-pipeline-export@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-export's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-export
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-pipeline-monitor images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-monitor.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-monitor-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-monitor images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-monitor pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-monitor
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-monitor:*"
+            - "ghcr.io/uug-ai/hub-pipeline-monitor@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-monitor's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-monitor
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-pipeline-notification images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-notification.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-notification-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-notification images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-pipeline-notification releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-notification pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-notification
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-notification:*"
+            - "ghcr.io/uug-ai/hub-pipeline-notification@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-notification's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-notification
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-pipeline-notification-test images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-notification-test.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-notification-test-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-notification-test images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-pipeline-notification-test releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-notification-test pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-notification-test
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-notification-test:*"
+            - "ghcr.io/uug-ai/hub-pipeline-notification-test@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-notification-test's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-notification-test
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-pipeline-sequence images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-sequence.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-sequence-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-sequence images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-sequence pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-sequence
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-sequence:*"
+            - "ghcr.io/uug-ai/hub-pipeline-sequence@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-sequence's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-sequence
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-pipeline-sprite images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-sprite.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-sprite-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-sprite images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-pipeline-sprite releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-sprite pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-sprite
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-sprite:*"
+            - "ghcr.io/uug-ai/hub-pipeline-sprite@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-sprite's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-sprite
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-pipeline-throttler images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-throttler.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-throttler-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-throttler images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-throttler pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-throttler
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-throttler:*"
+            - "ghcr.io/uug-ai/hub-pipeline-throttler@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-throttler's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-throttler
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-pipeline-thumbnail images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-pipeline-thumbnail.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-thumbnail-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-thumbnail images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-pipeline-thumbnail releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-thumbnail pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-thumbnail
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-thumbnail:*"
+            - "ghcr.io/uug-ai/hub-pipeline-thumbnail@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-pipeline-thumbnail's own repository.
+                      githubWorkflowRepository: uug-ai/hub-pipeline-thumbnail
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,56 @@
+{{- /*
+hub-vlm images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-vlm.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-vlm-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-vlm images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not signed yet: uug-ai/hub-vlm releases need `sign: true` (and
+  # `id-token: write`) in their release workflow. Until then this policy stays
+  # in Audit, even when imageVerification.validationFailureAction is Enforce.
+  # Once signed, use the same line as hub-api-signed-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-vlm pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-vlm
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-vlm:*"
+            - "ghcr.io/uug-ai/hub-vlm@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-vlm's own repository.
+                      githubWorkflowRepository: uug-ai/hub-vlm
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-workflows images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-workflows.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-workflows-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-workflows images must be signed by UUG.AI
+    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-workflows pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-workflows
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-workflows:*"
+            - "ghcr.io/uug-ai/hub-workflows@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-workflows's own repository.
+                      githubWorkflowRepository: uug-ai/hub-workflows
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -28,13 +28,14 @@ mode: "all"
 ###########################################################################
 # Image signature verification (Kyverno)
 ###########################################################################
-# Kyverno policies in templates/kyverno/ (one file per image) requiring UUG.AI
-# images to be signed by UUG.AI. Opt-in: when enabled, they are created only
-# if Kyverno is installed.
+# Kyverno policies in templates/kyverno/ (one file per ghcr.io/uug-ai image)
+# requiring UUG.AI images to be signed by UUG.AI. Opt-in: when enabled, they are
+# created only if Kyverno is installed.
 imageVerification:
  enabled: false
  # Audit: report unsigned images (PolicyReports) but let them run.
  # Enforce: reject pods whose image is unsigned or signed for another repository.
+  # Images whose releases are not signed yet always stay in Audit (see README).
  validationFailureAction: Audit
 ###########################################################################
 # Global configuration