All Policies
Require Images Use Checksums
Use of a SHA checksum when pulling an image is often preferable because tags are mutable and can be overwritten. This policy checks to ensure that all images use SHA checksums rather than tags.
Policy Definition
/other/require-image-checksum/require-image-checksum.yaml
1apiVersion: kyverno.io/v1
2kind: ClusterPolicy
3metadata:
4 name: require-image-checksum
5 annotations:
6 policies.kyverno.io/title: Require Images Use Checksums
7 policies.kyverno.io/category: Sample
8 policies.kyverno.io/severity: medium
9 policies.kyverno.io/subject: Pod
10 policies.kyverno.io/minversion: 1.6.0
11 policies.kyverno.io/description: >-
12 Use of a SHA checksum when pulling an image is often preferable because tags
13 are mutable and can be overwritten. This policy checks to ensure that all images
14 use SHA checksums rather than tags.
15spec:
16 validationFailureAction: audit
17 background: true
18 rules:
19 - name: require-image-checksum
20 match:
21 any:
22 - resources:
23 kinds:
24 - Pod
25 validate:
26 message: "Images must use checksums rather than tags."
27 pattern:
28 spec:
29 containers:
30 - image: "*@*"