World map

 

BM

World K6: Guards

Supply-chain recap

You will learn: how a sealed image travels from your pipeline to the cluster, and how gate 3 checks the seal.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

A pack in the shop freezer has your name and your tag. But someone swapped what is inside. How does the cluster find out?

Watch

Tap each point on the timeline.

Recap from World D5: Ship & Shield and Part 2. The seal is an image signature: A tamper-proof seal on a pack: it proves who built the image and that nobody changed it.. Tap each step.

Try it

An SBOM: Software bill of materials: the ingredients label. It lists every package and version inside. and a seal prove different things. Sort them.

Drag a card into a box. Or tap the card, then tap the box.

      Predict

      The policy wants your pipeline’s seal. Someone pushes a new image under the same tag, shop:1.4.0. What happens at gate 3?

      Watch

      GitHub’s guide uses Sigstore’s policy controller at gate 3. A label on the zone switches it on. Tap that label.

      Tap the label that turns on seal checks.

      0 of 1 found

      Check

      Can this image line point at a different pack tomorrow? Pinned is good. Movable needs work.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4ghcr.io/kedai/shop@sha256:…

      You did it!

      You can now explain how a sealed image reaches the cluster safely.

      Go deeper (optional)

      More in World D5’s lesson “SBOM, provenance and signing”. SLSA lives in Part 2’s Pipeline Shields. Kyverno and Gatekeeper can check seals too. Kubernetes signs its own release images with Sigstore. You can check them before you install.

      Real mission

      2. gh attestation verify oci://ghcr.io/YOUR-NAME/YOUR-REPO:main -R YOUR-NAME/YOUR-REPO

      0 of 3 steps done · Your ticks are saved.