ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/policies/restrict-zot-image-pulls.yaml

@@ -0,0 +1,38 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: restrict-zot-image-pulls
+  annotations:
+    policies.kyverno.io/title: Restrict Zot image pulls
+    policies.kyverno.io/category: Supply Chain
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/description: >-
+      Reserve Zot for the images required to bootstrap and operate OLM, Quay,
+      and PostgreSQL. Cluster workloads pull all other internal images from Quay.
+spec:
+  validationFailureAction: Enforce
+  background: true
+  rules:
+    - name: deny-unapproved-zot-images
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      validate:
+        message: >-
+          Zot is restricted to the Project Quay catalog, Quay operator, Quay
+          server, and approved PostgreSQL image repositories.
+        foreach:
+          - list: "request.object.spec.[initContainers, ephemeralContainers, containers][]"
+            deny:
+              conditions:
+                all:
+                  - key: >-
+                      {{ regex_match('(?i)^zot\.quorate\.internal(:[0-9]+)?/.*$', element.image) }}
+                    operator: Equals
+                    value: true
+                  - key: >-
+                      {{ regex_match('(?i)^zot\.quorate\.internal(:[0-9]+)?/(olm/(project-quay-catalog|quay-operator)|quay/quay|quorate/cnpg-postgresql)([:@].*)?$', element.image) }}
+                    operator: Equals
+                    value: false