apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: mutatedigest-policy
spec:
  validationFailureAction: enforce
  webhookTimeoutSeconds: 30
  rules:
    - name: mutatedigest-rule
      match:
        any:
        - resources:
            kinds:
              - Pod
      verifyImages:
      - imageReferences:
        - "ghcr.io/kyverno/test-verify-image*"
        mutateDigest: true
        verifyDigest: false
        required: false