You can prevent containers from running images from unauthorized Docker image registries in selected Kubernetes namespaces.
For example, you can allow images to be pulled only from your company registry registry.company.com. This reduces the risk of running images from untrusted sources.
Configuring the file
To check the source of Docker images, configure the estrictImageRegistries block in the values-policies.yaml:
...
## This policy allows containers to run only images from trusted registries
restrictImageRegistries:
enabled: true
## Namespaces where the image registry restrictions policy will apply
namespace:
- brix365
## Allowed Docker image registries
allowedRegistries:
- registry.company.com
...
Where:
- restrictImageRegistries.enabled : set the value true to enable registry checks. Set false to disable registry checks.
- restrictImageRegistries.namespace: specify the namespaces where the policy will apply.
- restrictImageRegistries.allowedRegistries: specify the allowed image registries.
After configuring the security policy, install the kyverno-policies chart as described in step 3 of stage 2 in Install Kyverno.