updated policy to actually work as expected

cartyc · Jul 6, 2020 · d0977d9 · d0977d9
1 parent 906c1cb
commit d0977d9
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 7 deletions.
diff --git a/latest-tag/constraint.yaml b/latest-tag/constraint.yaml
@@ -7,6 +7,6 @@ spec:
     kinds:
       - apiGroups: [""]
         kinds: ["Pod"]
-    parameters:
-      tags:
-        - "latest"
+  parameters:
+    tags:
+      - "latest"
diff --git a/latest-tag/template.yaml b/latest-tag/template.yaml
@@ -23,11 +23,10 @@ spec:
 
         violation[{"msg":msg}] {
             container := input.review.object.spec.containers[_]
-            tag :=  split(container.image, ":")[1]
 
-            not tag != "latest"
-
-            msg := sprintf("container <%v> uses '%v' tag", [container.name, tag])
+            satisfied := [good | tags = input.parameters.tags[_] ; good = endswith(container.image, tags)]
+            any(satisfied)
+            msg := sprintf("container <%v> uses '%v' tag. Disallowed tags '%v'", [container.name, container.image, input.parameters.tags])
         }