Idea: kubectl plugin to embed signatures in objects

[dlorenc]

trafficstars

This could work something like:

1. Go through a k8s object looking for images
2. For each image, pull do something like "cosign verify" and get all verified payloads
3. Attach those payloads directly into the k8s object as annotations

This way deployment time policy enforcement (OPA, etc.) could look directly at the yaml rather than needing to interact with an external service.