Restrict Deprecated Registry in CEL expressions

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: restrict-deprecated-registry
 5  annotations:
 6    policies.kyverno.io/title: Restrict Deprecated Registry in CEL expressions
 7    policies.kyverno.io/category: Best Practices, EKS Best Practices in CEL 
 8    policies.kyverno.io/severity: high
 9    policies.kyverno.io/minversion: 1.11.0
10    kyverno.io/kubernetes-version: "1.27-1.28"
11    policies.kyverno.io/subject: Pod
12    policies.kyverno.io/description: >-
13      Legacy k8s.gcr.io container image registry will be frozen in early April 2023
14      k8s.gcr.io image registry will be frozen from the 3rd of April 2023.  
15      Images for Kubernetes 1.27 will not be available in the k8s.gcr.io image registry.
16      Please read our announcement for more details.
17      https://kubernetes.io/blog/2023/02/06/k8s-gcr-io-freeze-announcement/     
18spec:
19  validationFailureAction: Enforce
20  background: true
21  rules:
22  - name: restrict-deprecated-registry
23    match:
24      any:
25      - resources:
26          kinds:
27          - Pod
28          operations:
29          - CREATE
30          - UPDATE
31    validate:
32      cel:
33        variables:
34          - name: allContainers
35            expression: "object.spec.containers + object.spec.?initContainers.orValue([]) + object.spec.?ephemeralContainers.orValue([])"
36        expressions:
37          - expression: "variables.allContainers.all(container, !container.image.startsWith('k8s.gcr.io/'))"
38            message: "The \"k8s.gcr.io\" image registry is deprecated. \"registry.k8s.io\" should now be used."
39