apiVersion: v1
kind: Pod
metadata:
  name: test-pod-good
  namespace: default
  labels:
    prod: "true"
spec:
  containers:
    - name: nginx
      image: 'ghcr.io/kyverno/test-verify-image:signed'