rblundon
fe564d7227
git-subtree-dir: cluster-config git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c
44 lines
1.3 KiB
YAML
44 lines
1.3 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: verify-signed-image
|
|
annotations:
|
|
policies.kyverno.io/title: Verify Signed Images
|
|
policies.kyverno.io/category: Security
|
|
policies.kyverno.io/severity: high
|
|
policies.kyverno.io/subject: Pod
|
|
policies.kyverno.io/description: >-
|
|
Validates signed images against specified certificates
|
|
spec:
|
|
validationFailureAction: audit
|
|
failurePolicy: Ignore
|
|
background: false
|
|
webhookTimeoutSeconds: 30
|
|
rules:
|
|
- name: verify-image-quay-io-gnunn-client
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
verifyImages:
|
|
- image: "quay.io/gnunn/client:*"
|
|
key: |-
|
|
-----BEGIN PUBLIC KEY-----
|
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjWno6IupPFSRi9btNhFtMeS1iQbM
|
|
gN6OWsfUdhfT5TCf23ESE3vfuMWtX9syvjmemuGpZ+/fRDOyqAbVnAGNpQ==
|
|
-----END PUBLIC KEY-----
|
|
- name: verify-image-quay-io-gnunn-server
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
verifyImages:
|
|
- image: "quay.io/gnunn/server:*"
|
|
key: |-
|
|
-----BEGIN PUBLIC KEY-----
|
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjWno6IupPFSRi9btNhFtMeS1iQbM
|
|
gN6OWsfUdhfT5TCf23ESE3vfuMWtX9syvjmemuGpZ+/fRDOyqAbVnAGNpQ==
|
|
-----END PUBLIC KEY-----
|