mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-06 16:06:56 +00:00
34 lines
864 B
YAML
34 lines
864 B
YAML
|
apiVersion: kyverno.io/v1
|
||
|
|
kind: ClusterPolicy
|
||
|
|
metadata:
|
||
|
|
name: images
|
||
|
|
spec:
|
||
|
|
validationFailureAction: enforce
|
||
|
|
rules:
|
||
|
|
- name: only-allow-trusted-images
|
||
|
|
match:
|
||
|
|
resources:
|
||
|
|
kinds:
|
||
|
|
- Pod
|
||
|
|
preconditions:
|
||
|
|
- key: "{{request.operation}}"
|
||
|
|
operator: NotEquals
|
||
|
|
value: DELETE
|
||
|
|
validate:
|
||
|
|
message: "images with root user are not allowed"
|
||
|
|
foreach:
|
||
|
|
- list: "request.object.spec.containers"
|
||
|
|
context:
|
||
|
|
- name: imageData
|
||
|
|
imageRegistry:
|
||
|
|
reference: "{{ element.image }}"
|
||
|
|
deny:
|
||
|
|
conditions:
|
||
|
|
all:
|
||
|
|
- key: "{{ imageData.configData.config.User || ''}}"
|
||
|
|
operator: Equals
|
||
|
|
value: ""
|
||
|
|
- key: "{{ imageData.registry }}"
|
||
|
|
operator: NotEquals
|
||
|
|
value: "ghcr.io"
|