k8sdisallowedtags

Basic Information

• Policy type: compliance
• Recommended level: L1
• Effective resource type: Pod
• Parameter

  tags: String array

  exemptImages: String array

Function

This policy restricts the container image tag.

Policy Example

The following policy instance shows the types of resources for which the policy definition takes effect. parameters indicates that the container image tag cannot be latest.

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDisallowedTags
metadata:
  name: container-image-must-not-have-latest-tag
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "default"
  parameters:
    tags: ["latest"]
    exemptImages: ["openpolicyagent/opa-exp:latest", "openpolicyagent/opa-exp2:latest"] 

Resource Definition That Complies with the Policy

The container image tag is not latest, which complies with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: opa-allowed
spec:
  containers:
    - name: opa
      image: openpolicyagent/opa:0.9.2
      args:
        - "run"
        - "--server"
        - "--addr=localhost:8080"

Resource Definition That Does Not Comply with the Policy

The container image tag is latest, which does not comply with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: opa-disallowed-2
spec:
  containers:
    - name: opa
      image: openpolicyagent/opa:latest
      args:
        - "run"
        - "--server"
        - "--addr=localhost:8080"