All Policies

Resolve Image to Digest

Image tags are mutable and the change of an image can result in the same tag. This policy resolves the image digest of each image in a container and replaces the image with the fully resolved reference which includes the digest rather than tag.

Policy Definition

/other/resolve-image-to-digest/resolve-image-to-digest.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: resolve-image-to-digest
 5  annotations:
 6    policies.kyverno.io/title: Resolve Image to Digest
 7    policies.kyverno.io/category: Other
 8    policies.kyverno.io/severity: medium
 9    kyverno.io/kyverno-version: 1.6.0
10    policies.kyverno.io/minversion: 1.6.0
11    kyverno.io/kubernetes-version: "1.23"
12    policies.kyverno.io/subject: Pod
13    policies.kyverno.io/description: >-
14      Image tags are mutable and the change of an image can result in the same tag.
15      This policy resolves the image digest of each image in a container and replaces
16      the image with the fully resolved reference which includes the digest rather than tag.
17spec:
18  background: false
19  rules:
20  - name: resolve-to-digest
21    match:
22      any:
23      - resources:
24          kinds:
25          - Pod
26    preconditions:
27      all:
28      - key: "{{request.operation || 'BACKGROUND'}}"
29        operator: NotEquals
30        value: DELETE
31    mutate:
32      foreach:
33      - list: "request.object.spec.containers"
34        context:
35          - name: resolvedRef
36            imageRegistry:
37              reference: "{{ element.image }}"
38              jmesPath: "resolvedImage"
39        patchStrategicMerge:
40          spec:
41            containers:
42            - name: "{{ element.name }}"           
43              image: "{{ resolvedRef }}"