opendesk/.kyverno/policies/require-imagepullpolicy-always.yaml

# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
# SPDX-License-Identifier: Apache-2.0
---
apiVersion: "kyverno.io/v1"
kind: "ClusterPolicy"
metadata:
  name: "require-imagepullpolicy-always"
spec:
  background: true
  rules:
    - match:
        resources:
          kinds:
            - "Pod"
      name: "require-imagepullpolicy-always"
      validate:
        message: "The imagePullPolicy must be set to `Always` when the tag `latest` is used."
        anyPattern:
          - spec:
              =(ephemeralContainers):
                - (image): "*:latest"
                  imagePullPolicy: "Always"
              =(initContainers):
                - (image): "*:latest"
                  imagePullPolicy: "Always"
              containers:
                - (image): "*:latest"
                  imagePullPolicy: "Always"
          - spec:
              =(ephemeralContainers):
                - (image): "!*:latest"
                  imagePullPolicy: "IfNotPresent"
              =(initContainers):
                - (image): "!*:latest"
                  imagePullPolicy: "IfNotPresent"
              containers:
                - (image): "!*:latest"
                  imagePullPolicy: "IfNotPresent"
  validationFailureAction: "audit"
...