Delete clustertool/embed/generic/kubernetes/core/kyverno-policies/app directory
Signed-off-by: Kjeld Schouten <info@kjeldschouten.nl>
This commit is contained in:
@@ -1,53 +0,0 @@
|
|||||||
## This Can be enabled in the kustomization.yaml file.
|
|
||||||
## Please note not every chart or application is compatible with this behavior
|
|
||||||
## Primarily operators spinning their own pods, might include conflicting validation
|
|
||||||
## Add manual exclusions where needed
|
|
||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: ClusterPolicy
|
|
||||||
metadata:
|
|
||||||
name: resolve-image-to-digest
|
|
||||||
annotations:
|
|
||||||
policies.kyverno.io/title: Resolve Image to Digest
|
|
||||||
policies.kyverno.io/category: Other
|
|
||||||
policies.kyverno.io/severity: medium
|
|
||||||
kyverno.io/kyverno-version: 1.6.0
|
|
||||||
policies.kyverno.io/minversion: 1.6.0
|
|
||||||
kyverno.io/kubernetes-version: "1.23"
|
|
||||||
policies.kyverno.io/subject: Pod
|
|
||||||
policies.kyverno.io/description: >-
|
|
||||||
Image tags are mutable and the change of an image can result in the same tag.
|
|
||||||
This policy resolves the image digest of each image in a container and replaces
|
|
||||||
the image with the fully resolved reference which includes the digest rather than tag.
|
|
||||||
spec:
|
|
||||||
background: false
|
|
||||||
rules:
|
|
||||||
- name: resolve-to-digest
|
|
||||||
match:
|
|
||||||
any:
|
|
||||||
- resources:
|
|
||||||
kinds:
|
|
||||||
- Pod
|
|
||||||
exclude:
|
|
||||||
any:
|
|
||||||
- resources:
|
|
||||||
kinds:
|
|
||||||
- Pod
|
|
||||||
name: '*cnpg*'
|
|
||||||
preconditions:
|
|
||||||
all:
|
|
||||||
- key: "{{request.operation || 'BACKGROUND'}}"
|
|
||||||
operator: NotEquals
|
|
||||||
value: DELETE
|
|
||||||
mutate:
|
|
||||||
foreach:
|
|
||||||
- list: "request.object.spec.containers"
|
|
||||||
context:
|
|
||||||
- name: resolvedRef
|
|
||||||
imageRegistry:
|
|
||||||
reference: "{{ element.image }}"
|
|
||||||
jmesPath: "resolvedImage"
|
|
||||||
patchStrategicMerge:
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: "{{ element.name }}"
|
|
||||||
image: "{{ resolvedRef }}"
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
resources:
|
|
||||||
- schematic-to-pod.yaml
|
|
||||||
# - ensure-digest.yaml
|
|
||||||
Reference in New Issue
Block a user