apiVersion: v1
kind: Pod
metadata:
  name: allowed-quay-bootstrap
  namespace: olm
spec:
  initContainers:
    - name: operator
      image: zot.quorate.internal/olm/quay-operator@sha256:36c4e8f
  containers:
    - name: catalog
      image: zot.quorate.internal/olm/project-quay-catalog:v3@sha256:f9ab42bc1
  ephemeralContainers:
    - name: quay
      image: zot.quorate.internal/quay/quay:3.17.1
---
apiVersion: v1
kind: Pod
metadata:
  name: allowed-postgres
  namespace: postgres
spec:
  containers:
    - name: postgres
      image: zot.quorate.internal/quorate/cnpg-postgresql:18.4@sha256:facda7b
---
apiVersion: v1
kind: Pod
metadata:
  name: allowed-non-zot
  namespace: default
spec:
  containers:
    - name: quay
      image: registry.quorate.internal/quorate/example:v1
    - name: external
      image: docker.io/library/busybox:1.36
---
apiVersion: v1
kind: Pod
metadata:
  name: blocked-container
  namespace: default
spec:
  containers:
    - name: app
      image: zot.quorate.internal/infrastructure/oci-l4-relay-agent:v1
---
apiVersion: v1
kind: Pod
metadata:
  name: blocked-init-container
  namespace: olm
spec:
  initContainers:
    - name: init
      image: zot.quorate.internal/olm/other:v1
  containers:
    - name: app
      image: registry.quorate.internal/quorate/example:v1
---
apiVersion: v1
kind: Pod
metadata:
  name: blocked-ephemeral-container
  namespace: kube-system
spec:
  containers:
    - name: app
      image: registry.quorate.internal/quorate/example:v1
  ephemeralContainers:
    - name: debug
      image: zot.quorate.internal/debug/tool:v1
---
apiVersion: v1
kind: Pod
metadata:
  name: blocked-quay-lookalike
  namespace: quay
spec:
  containers:
    - name: app
      image: zot.quorate.internal/quay/quay-evil:v1
---
apiVersion: v1
kind: Pod
metadata:
  name: blocked-postgres-lookalike
  namespace: postgres
spec:
  containers:
    - name: app
      image: zot.quorate.internal/quorate/cnpg-postgresql-copy:v1
---
apiVersion: v1
kind: Pod
metadata:
  name: blocked-explicit-port
  namespace: default
spec:
  containers:
    - name: app
      image: zot.quorate.internal:443/infrastructure/blocked:v1
---
apiVersion: v1
kind: Pod
metadata:
  name: blocked-uppercase-host
  namespace: default
spec:
  containers:
    - name: app
      image: ZOT.quorate.internal/infrastructure/blocked:v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: blocked-deployment
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: blocked-deployment
  template:
    metadata:
      labels:
        app: blocked-deployment
    spec:
      containers:
        - name: app
          image: zot.quorate.internal/infrastructure/blocked:v1
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: blocked-cronjob
  namespace: default
spec:
  schedule: "0 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          containers:
            - name: app
              image: zot.quorate.internal/infrastructure/blocked:v1