<h1>Wished Behavior</h1>
<ol>
<li>Write OPA policy which check if image-name contain default latest tag. The following is my .rego file :</li>
</ol>
<pre><code>package kubernetes.admission

import data.kubernetes.namespaces


deny[msg] {
    input.request.kind.kind == &quot;Pod&quot;
    input.request.operation == &quot;CREATE&quot;
    container := input.request.object.spec.containers[_]
    [image_name, image_tag] := split(container.image, &quot;:&quot;)
    image_tag == &quot;latest&quot;
    msg := sprintf(&quot;Invalid image tag&quot;)
}
</code></pre>
<ol start="2">
<li>Load the policy by creating a configmap. I used the following command:</li>
</ol>
<pre><code>kubectl create configmap registry-whitelist --from-file image-checker.rego
</code></pre>
<blockquote>
<p>The default namespace in my current context is <code>opa</code>.</p>
</blockquote>
<ol start="3">
<li>After that it's supposed that I can exercise the policy by creating a pod with latest tag and it has to be rejected.</li>
</ol>
<h2>Actual Behavior</h2>
<p>Pods with latest tags are created successfully and they are not rejected.</p>
<h2>Steps to Reproduce the Problem</h2>
<p>I followed these tips <a href="https://www.openpolicyagent.org/docs/latest/kubernetes-debugging/" rel="nofollow noreferrer">https://www.openpolicyagent.org/docs/latest/kubernetes-debugging/</a> .</p>
<p>So, it's expected that the created configmap <code>registry-whitelist</code> has <code>openpolicyagent.org/policy-status</code> as annotations, however it has <code>&lt;none&gt;</code> as value, also I have checked logs of <code>kube-mgmt</code> container however they didn't help me. The only interesting log i get is when i try to delete the configmap <code>registry-whitelist</code> I can see the following log :</p>
<p><strong>level=error msg=&quot;Failed to delete policy opa/registry-whitelist/image-checker.rego: code resource_not_found: storage_not_found_error: policy id &quot;opa/registry-whitelist/image-checker.rego&quot;&quot;</strong></p>

<p>Problem solved: actually my policy which is writen in rego had some errors this is why kube-mgmt took some time before adding the annotations to the new created configmap. After a while I found an annotation saying that my policy had errors .</p>
