43 lines
1.6 KiB
YAML
43 lines
1.6 KiB
YAML
apiVersion: templates.gatekeeper.sh/v1beta1
|
|
kind: ConstraintTemplate
|
|
metadata:
|
|
name: k8sallowedrepos
|
|
annotations:
|
|
description: Requires container images to begin with a repo string from a
|
|
specified list.
|
|
spec:
|
|
crd:
|
|
spec:
|
|
names:
|
|
kind: K8sAllowedRepos
|
|
validation:
|
|
# Schema for the `parameters` field
|
|
openAPIV3Schema:
|
|
properties:
|
|
repos:
|
|
type: array
|
|
items:
|
|
type: string
|
|
targets:
|
|
- target: admission.k8s.gatekeeper.sh
|
|
rego: |
|
|
package k8sallowedrepos
|
|
|
|
violation[{"msg": msg}] {
|
|
container := input.review.object.spec.containers[_]
|
|
not strings.any_prefix_match(container.image, input.parameters.repos)
|
|
msg := sprintf("container <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
|
|
}
|
|
|
|
violation[{"msg": msg}] {
|
|
container := input.review.object.spec.initContainers[_]
|
|
not strings.any_prefix_match(container.image, input.parameters.repos)
|
|
msg := sprintf("initContainer <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
|
|
}
|
|
|
|
violation[{"msg": msg}] {
|
|
container := input.review.object.spec.ephemeralContainers[_]
|
|
not strings.any_prefix_match(container.image, input.parameters.repos)
|
|
msg := sprintf("ephemeralContainer <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
|
|
}
|