Require Images Use Checksums

Use of a SHA checksum when pulling an image is often preferable because tags are mutable and can be overwritten. This policy checks to ensure that all images use SHA checksums rather than tags.

Policy Definition

/other/require_image_checksum.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: require-image-checksum
 5  annotations:
 6    policies.kyverno.io/title: Require Images Use Checksums
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/subject: Pod
10    policies.kyverno.io/description: >-
11      Use of a SHA checksum when pulling an image is often preferable because tags
12      are mutable and can be overwritten. This policy checks to ensure that all images
13      use SHA checksums rather than tags.      
14spec:
15  validationFailureAction: audit
16  background: true
17  rules:
18  - name: require-image-checksum
19    match:
20      resources:
21        kinds:
22        - Pod
23    validate:
24      message: "Images must use checksums rather than tags."  
25      pattern:
26        spec:
27          containers:
28          - image: "*@*"

Create policy issue