Summary
All webhook infrastructure in config/default/kustomization.yaml is commented out. While CEL rules on the CRD handle most validation, the NSA MCP Security Design Considerations (May 2026) recommend defense-in-depth for parameter validation and choosing supported MCP projects.
Proposal
Enable the existing webhook scaffolding and add runtime policy enforcement:
- Cross-resource validation (e.g., reject images from untrusted registries)
- Runtime policy enforcement that can be updated without CRD version changes
- Optional image registry allowlist for
spec.source.containerImage.ref
Notes
Full image signature verification (cosign/sigstore) is typically a platform-level concern (e.g., OpenShift image signature verification, policy-controller). A lightweight registry allowlist in the webhook provides defense-in-depth without duplicating platform responsibilities.
Reference: NSA CSI MCP Security Design Considerations - "Validate parameters", "Choose supported MCP projects"
https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI_MCP_SECURITY.pdf
Summary
All webhook infrastructure in
config/default/kustomization.yamlis commented out. While CEL rules on the CRD handle most validation, the NSA MCP Security Design Considerations (May 2026) recommend defense-in-depth for parameter validation and choosing supported MCP projects.Proposal
Enable the existing webhook scaffolding and add runtime policy enforcement:
spec.source.containerImage.refNotes
Full image signature verification (cosign/sigstore) is typically a platform-level concern (e.g., OpenShift image signature verification, policy-controller). A lightweight registry allowlist in the webhook provides defense-in-depth without duplicating platform responsibilities.
Reference: NSA CSI MCP Security Design Considerations - "Validate parameters", "Choose supported MCP projects"
https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI_MCP_SECURITY.pdf