ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/restrict-image-registries.yaml

@@ -0,0 +1,53 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-image-registries
+  annotations:
+    policies.kyverno.io/title: Restrict image registries (audit)
+    policies.kyverno.io/category: Supply Chain
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/description: >-
+      Audit containers that pull outside the internal registry endpoints ahead
+      of Phase 4 image trust. Zot repository access is enforced separately.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: allow-internal-registries-only
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kube-system
+                - kube-public
+                - kube-node-lease
+                - flux-system
+                - flux-canary
+                - kyverno
+                - cert-manager
+                - cilium-secrets
+                - olm
+                - operators
+                - longhorn
+                - openebs
+                - intel-system
+                - nfd
+      validate:
+        message: >-
+          Prefer an internal registry endpoint. External registries are inventory
+          for the mirror/promote pipeline, and Zot repositories are separately
+          restricted.
+        foreach:
+          - list: "request.object.spec.[initContainers, ephemeralContainers, containers][]"
+            deny:
+              conditions:
+                all:
+                  - key: >-
+                      {{ regex_match('^(quay\.quorate\.internal/|zot\.quorate\.internal/|registry\.quorate\.internal/)', element.image) }}
+                    operator: Equals
+                    value: false