pkg/safeguards/lib/manifests/v2.0.0/container-restricted-image-pulls/template.yaml [1:46]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sazurev1containerrestrictedimagepulls
spec:
  crd:
    spec:
      names:
        kind: K8sAzureV1ContainerRestrictedImagePulls
      validation:
        # Schema for the `parameters` field
        openAPIV3Schema:
          properties:
            excludedImages:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sazurev1containerrestrictedimagepulls

        has_key(object, key) {
          _ = object[key]
        }

        violation[{"msg": msg}] {
          container := input_containers[_]
          not is_excluded(container)
          not has_key(input.review.object.spec, "imagePullSecrets")
          namespace := input.review.namespace
          pod := input.review.object.metadata.name
          msg := sprintf("%s in %s does not have imagePullSecrets. Unauthenticated image pulls are not recommended.", [pod, namespace])
        }

        input_containers[c] {
          c := input.review.object.spec.containers[_]
        }

        input_containers[c] {
          c := input.review.object.spec.initContainers[_]
        }

        input_containers[c] {
          c := input.review.object.spec.ephemeralContainers[_]
        }
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



pkg/safeguards/lib/v1.0.0/container-restricted-image-pulls/template.yaml [1:46]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sazurev1containerrestrictedimagepulls
spec:
  crd:
    spec:
      names:
        kind: K8sAzureV1ContainerRestrictedImagePulls
      validation:
        # Schema for the `parameters` field
        openAPIV3Schema:
          properties:
            excludedImages:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sazurev1containerrestrictedimagepulls

        has_key(object, key) {
          _ = object[key]
        }        

        violation[{"msg": msg}] {
          container := input_containers[_]
          not is_excluded(container)
          not has_key(input.review.object.spec, "imagePullSecrets")
          namespace := input.review.namespace
          pod := input.review.object.metadata.name
          msg := sprintf("%s in %s does not have imagePullSecrets. Unauthenticated image pulls are not recommended.", [pod, namespace])
        }

        input_containers[c] {
          c := input.review.object.spec.containers[_]
        }

        input_containers[c] {
          c := input.review.object.spec.initContainers[_]
        }

        input_containers[c] {
          c := input.review.object.spec.ephemeralContainers[_]
        }
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



