[Bug] Dynamic key configuration is not working for kms
Author: smmit988-makerCreated Sep 22, 2026Updated Sep 30, 2026
Labelsbugtriage
Kyverno Version
1.18.0
Kubernetes Version
1.32.x
Kubernetes Platform
Minikube
Kyverno Rule Type
verifyImages
Description
I am trying to upgrade version from v1.13 to v1.18. In cluster policy I used kms for verification with kms: hashivault://{{request.namespace}}. But I got an error in new version: image verification failed error="failed to build cosign verification opts: failed to load public key from hashivault://{{request.namespace}}: kms specification should be in the format hashivault://<key>"
Steps to reproduce
- Apply the policy
apiVersion: policies.kyverno.io/v1
kind: ImageValidatingPolicy
metadata:
name: disallow-unsigned-images2
spec:
evaluation:
background:
enabled: false
validationActions: [Deny]
webhookConfiguration:
timeoutSeconds: 15
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups: ['']
apiVersions: ['v1']
operations: [CREATE, UPDATE]
resources: [pods]
credentials:
secrets:
- regcred
attestors:
- name: cosign
cosign:
key:
kms: 'hashivault://{{request.namespace}}'
ctlog:
url: 'https://rekor.sigstore.dev'
insecureIgnoreTlog: true
insecureIgnoreSCT: true
validations:
- message: 'Image is not signed. Build your image in pipeline and sign it'
expression: >-
images.containers
.filter(image,
!image.contains("proxy") &&)
.map(image, verifyImageSignatures(image, [attestors.cosign]))
.all(e, e > 0)- Try to use it
Expected behavior
Key field can read CEL or can be dynamic modified. I want to be able to verify different signs by different namespaces like in v1.13
Screenshots
No response
Kyverno logs
Slack discussion
No response
Troubleshooting
- I have read and followed the documentation AND the troubleshooting guide.
- I have searched other issues in this repository and mine is not recorded.
Source: kyverno/kyverno