Platform & DevOps·Secrets, identity and the supply chain
the cluster refuses to run an image that is not signed by your pipeline, so a pushed-by-hand image simply will not start.
Artefact signing
Also calledimage signing, code signing, signature verification
Cryptographically signing published artefacts and verifying the signature before running them. Signing alone changes nothing — the value is entirely in the verification step at admission, which is the part teams skip. It binds to the digest rather than the tag, which is why an estate that deploys by mutable tag cannot meaningfully enforce it.