---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: image-registry-allowlist
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: only-allowed-registries
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Images must come from approved registries (public.ecr.aws/* or nginx*)"
        anyPattern:
          - spec:
              containers:
                - image: "public.ecr.aws/*"
          - spec:
              containers:
                - image: "nginx*"