Files
opendesk/.kyverno/policies/require-tag-and-digest.yaml
2024-01-23 21:07:56 +01:00

28 lines
743 B
YAML

# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
# SPDX-License-Identifier: Apache-2.0
---
apiVersion: "kyverno.io/v1"
kind: "ClusterPolicy"
metadata:
name: "require-tag-and-digest"
spec:
background: true
rules:
- match:
resources:
kinds:
- "Pod"
name: "require-tag-and-digest"
validate:
message: "An image tag and digest required."
pattern:
spec:
=(ephemeralContainers):
- image: "*:*@sha256:*"
=(initContainers):
- image: "*:*@sha256:*"
containers:
- image: "*:*@sha256:*"
validationFailureAction: "audit"
...