Documentation
apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: restrict-image-registries spec: validationFailureAction: enforce background: true rules:
- name: allow-only-approved-registries
match:
resources:
kinds:
- Pod
validate:
message: "Images must be from approved registries: ghcr.io, docker.io, your-registry.com."
pattern:
spec:
containers:
- image: "ghcr.io/* | docker.io/* | your-registry.com/*"
- Pod
validate:
message: "Images must be from approved registries: ghcr.io, docker.io, your-registry.com."
pattern:
spec:
containers: