---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: images
spec:
  admission: true
  background: true
  rules:
  - match:
      any:
      - resources:
          kinds:
          - Pod
    name: only-allow-trusted-images
    preconditions:
      all:
      - key: '{{request.operation}}'
        operator: NotEquals
        value: DELETE
    validate:
      foreach:
      - context:
        - imageRegistry:
            reference: '{{ element.image }}'
          name: imageData
        deny:
          conditions:
            all:
            - key: '{{ imageData.configData.config.User || ''''}}'
              operator: Equals
              value: ""
            - key: '{{ imageData.registry }}'
              operator: NotEquals
              value: ghcr.io
        list: request.object.spec.containers
      message: images with root user are not allowed
  validationFailureAction: Enforce
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-image-base
spec:
  admission: true
  background: true
  rules:
  - match:
      any:
      - resources:
          kinds:
          - Pod
    name: check-image-base-rule
    preconditions:
      all:
      - key: '{{request.operation}}'
        operator: NotEquals
        value: DELETE
    validate:
      foreach:
      - context:
        - imageRegistry:
            reference: '{{ element.image }}'
          name: imageData
        - name: mobysource
          variable:
            default: 0
            jmesPath: imageData.configData."moby.buildkit.buildinfo.v1" | base64_decode(@).parse_json(@)
              | sources[].ref | length(@)
        deny:
          conditions:
            all:
            - key: '{{ mobysource }}'
              operator: Equals
              value: 0
        list: request.object.spec.containers
      message: Images must specify a source/base image from which they are built to
        be valid.
  validationFailureAction: Enforce