apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-zot-image-pulls
  annotations:
    policies.kyverno.io/title: Restrict Zot image pulls
    policies.kyverno.io/category: Supply Chain
    policies.kyverno.io/severity: high
    policies.kyverno.io/description: >-
      Reserve Zot for the images required to bootstrap and operate OLM, Quay,
      and PostgreSQL. Cluster workloads pull all other internal images from Quay.
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: deny-unapproved-zot-images
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: >-
          Zot is restricted to the Project Quay catalog, Quay operator, Quay
          server, and approved PostgreSQL image repositories.
        foreach:
          - list: "request.object.spec.[initContainers, ephemeralContainers, containers][]"
            deny:
              conditions:
                all:
                  - key: >-
                      {{ regex_match('(?i)^zot\.quorate\.internal(:[0-9]+)?/.*$', element.image) }}
                    operator: Equals
                    value: true
                  - key: >-
                      {{ regex_match('(?i)^zot\.quorate\.internal(:[0-9]+)?/(olm/(project-quay-catalog|quay-operator)|quay/quay|quorate/cnpg-postgresql)([:@].*)?$', element.image) }}
                    operator: Equals
                    value: false