---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: secure-images
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
spec:
  validationFailureAction: enforce
  background: false
  webhookTimeoutSeconds: 30
  failurePolicy: Fail  
  rules:
    - name: enforce-signatures
      match:
        resources:
          kinds:
            - Pod
      verifyImages:
      - imageReferences:
        - "*"
        required: true
        verifyDigest: false
        mutateDigest: false 
