38 lines
1.4 KiB
YAML
38 lines
1.4 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: restrict-zot-image-pulls
|
|
annotations:
|
|
policies.kyverno.io/title: Restrict Zot image pulls
|
|
policies.kyverno.io/category: Supply Chain
|
|
policies.kyverno.io/severity: high
|
|
policies.kyverno.io/description: >-
|
|
Reserve Zot for the images required to bootstrap and operate OLM, Quay,
|
|
and PostgreSQL. Cluster workloads pull all other internal images from Quay.
|
|
spec:
|
|
validationFailureAction: Enforce
|
|
background: true
|
|
rules:
|
|
- name: deny-unapproved-zot-images
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
validate:
|
|
message: >-
|
|
Zot is restricted to the Project Quay catalog, Quay operator, Quay
|
|
server, and approved PostgreSQL image repositories.
|
|
foreach:
|
|
- list: "request.object.spec.[initContainers, ephemeralContainers, containers][]"
|
|
deny:
|
|
conditions:
|
|
all:
|
|
- key: >-
|
|
{{ regex_match('(?i)^zot\.quorate\.internal(:[0-9]+)?/.*$', element.image) }}
|
|
operator: Equals
|
|
value: true
|
|
- key: >-
|
|
{{ regex_match('(?i)^zot\.quorate\.internal(:[0-9]+)?/(olm/(project-quay-catalog|quay-operator)|quay/quay|quorate/cnpg-postgresql)([:@].*)?$', element.image) }}
|
|
operator: Equals
|
|
value: false
|