Require Images Use Checksums

Use of a SHA checksum when pulling an image is often preferable because tags are mutable and can be overwritten. This policy checks to ensure that all images use SHA checksums rather than tags.

Policy Definition

/other/require_image_checksum/require_image_checksum.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: require-image-checksum
 5  annotations:
 6    policies.kyverno.io/title: Require Images Use Checksums
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/subject: Pod
10    policies.kyverno.io/minversion: 1.6.0
11    policies.kyverno.io/description: >-
12      Use of a SHA checksum when pulling an image is often preferable because tags
13      are mutable and can be overwritten. This policy checks to ensure that all images
14      use SHA checksums rather than tags.      
15spec:
16  validationFailureAction: audit
17  background: true
18  rules:
19  - name: require-image-checksum
20    match:
21      any:
22      - resources:
23          kinds:
24          - Pod
25    validate:
26      message: "Images must use checksums rather than tags."
27      pattern:
28        spec:
29          containers:
30          - image: "*@*"

Create policy issue