All Policies
Resolve Image to Digest
Image tags are mutable and the change of an image can result in the same tag. This policy resolves the image digest of each image in a container and replaces the image with the fully resolved reference which includes the digest rather than tag.
Policy Definition
/other/resolve-image-to-digest/resolve-image-to-digest.yaml
1apiVersion: kyverno.io/v1
2kind: ClusterPolicy
3metadata:
4 name: resolve-image-to-digest
5 annotations:
6 policies.kyverno.io/title: Resolve Image to Digest
7 policies.kyverno.io/category: Other
8 policies.kyverno.io/severity: medium
9 kyverno.io/kyverno-version: 1.6.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.23"
12 policies.kyverno.io/subject: Pod
13 policies.kyverno.io/description: >-
14 Image tags are mutable and the change of an image can result in the same tag.
15 This policy resolves the image digest of each image in a container and replaces
16 the image with the fully resolved reference which includes the digest rather than tag.
17spec:
18 background: false
19 rules:
20 - name: resolve-to-digest
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 preconditions:
27 all:
28 - key: "{{request.operation || 'BACKGROUND'}}"
29 operator: NotEquals
30 value: DELETE
31 mutate:
32 foreach:
33 - list: "request.object.spec.containers"
34 context:
35 - name: resolvedRef
36 imageRegistry:
37 reference: "{{ element.image }}"
38 jmesPath: "resolvedImage"
39 patchStrategicMerge:
40 spec:
41 containers:
42 - name: "{{ element.name }}"
43 image: "{{ resolvedRef }}"