Require Images Use Checksums

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: require-image-checksum
 5  annotations:
 6    policies.kyverno.io/title: Require Images Use Checksums
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/subject: Pod
10    policies.kyverno.io/minversion: 1.6.0
11    policies.kyverno.io/description: >-
12      Use of a SHA checksum when pulling an image is often preferable because tags are mutable and can be overwritten. This policy checks to ensure that all images use SHA checksums rather than tags.      
13spec:
14  validationFailureAction: Audit
15  background: true
16  rules:
17  - name: require-image-checksum
18    match:
19      any:
20      - resources:
21          kinds:
22          - Pod
23    validate:
24      message: "Images must use checksums rather than tags."
25      pattern:
26        spec:
27          containers:
28          - image: "*@*"
29          =(ephemeralContainers):
30          - image: "*@*"
31          =(initContainers):
32          - image: "*@*"