---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-signature
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
spec:
  background: false
  validationFailureAction: enforce
  rules:
    - name: check-static-key
      match:
        resources:
          kinds:
          - Pod
      verifyImages:
        - imageReferences:
          - "ghcr.io/kyverno/test-verify-image:*"
          attestors:
          - entries:
            - keys:
                publicKeys: |-
                  -----BEGIN PUBLIC KEY-----
                  MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
                  5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
                  -----END PUBLIC KEY-----
