Restrict Deprecated Registry in ValidatingPolicy

 1apiVersion: policies.kyverno.io/v1alpha1
 2kind: ValidatingPolicy
 3metadata:
 4  name: restrict-deprecated-registry
 5  annotations:
 6    policies.kyverno.io/title: Restrict Deprecated Registry in ValidatingPolicy
 7    policies.kyverno.io/category: Best Practices, EKS Best Practices in vpol 
 8    policies.kyverno.io/severity: high
 9    policies.kyverno.io/minversion: 1.14.0
10    kyverno.io/kubernetes-version: "1.27-1.28"
11    policies.kyverno.io/subject: Pod
12    policies.kyverno.io/description: >-
13      Legacy k8s.gcr.io container image registry will be frozen in early April 2023
14      k8s.gcr.io image registry will be frozen from the 3rd of April 2023.  
15      Images for Kubernetes 1.27 will not be available in the k8s.gcr.io image registry.
16      Please read our announcement for more details.
17      https://kubernetes.io/blog/2023/02/06/k8s-gcr-io-freeze-announcement/     
18spec:
19  validationActions: [Deny]
20  evaluation:
21    background:
22      enabled: true
23  matchConstraints:
24    resourceRules:
25    - apiGroups:   [""]
26      apiVersions: ["v1"]
27      operations:  ["CREATE", "UPDATE"]
28      resources:   ["pods"]
29  variables:
30    - name: allContainers
31      expression: "object.spec.containers + object.spec.?initContainers.orValue([]) + object.spec.?ephemeralContainers.orValue([])"
32  validations:
33    - expression: "variables.allContainers.all(container, !container.image.startsWith('k8s.gcr.io/'))"
34      message: "The \"k8s.gcr.io\" image registry is deprecated. \"registry.k8s.io\" should now be used."
35